AI agents broke into 100 firms for pocket change. SEA’s online shops fit the target profile
For years, the small business owner in Penang or Cebu has relied on a quiet, unspoken form of security: obscurity. Who would bother hacking a family-run online furniture store when there are banks to rob? The logic was not wrong. Breaking in took skill, time and patience, and skilled criminals price their time like consultants. […] The post AI agents broke into 100 firms for pocket change. SEA’s…
A Chinese-speaking operator used an open-source agent platform called Cairn to break into the websites of over 100 companies, including Deere, SharkNinja, and Cummins, among others. The operation required fewer than 100 Chinese characters and took less than 23 hours per successful intrusion, costing about US$5,000 in tokens, or roughly US$50 per break-in.
The operator's targets were primarily online shops with traffic between 200,000 and 1.5 million, primarily in the US, Canada, Japan, and Australia. The goal was to plant a web shell for lasting access to shop and payment systems, which could be cashed in later. Southeast Asia, despite not being on the operator's initial list, is vulnerable due to its digital economy growing faster than its defenses, with only 68.5% of small businesses in ASEAN using specialized software to protect their infrastructure.
The recent compromise of the Rank Math PRO WordPress SEO plugin plugin highlights the risk small businesses face through the chain of plugins, themes, freelance developers, and forgotten admin panels.
Brief written by urgent.news from e27's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
