AI Tools Enable Mass Attacks for $25.46 Per Target

A Chinese-speaking attacker deployed three different AI harnesses and open-weight and public AI models to target 105 e-commerce sites across five days in September, compromising at least 27 companies. The campaign stole at least 600,000 payment card records from two victims and installed credit-card skimmers on five more sites, all for an average cost of $25.46 per successful attack and affecting at least one Fortune 500 company.

The economics of AI-powered attacks extend beyond this campaign. Researchers testing an orchestrating agent with Claude Opus achieved complete domain control in eight minutes for approximately $12. Meanwhile, the average price of initial access in dark markets has fallen from just over $1,400 to $429, while ransomware activity grew 45% despite only 28% of companies paying ransoms in the first half of 2026.

Organizations face an unfavorable economic position where cheap, scalable AI attacks overwhelm costly defenses. Security teams should focus on fundamental hardening—eliminating overprivileged accounts, preventing credential reuse, and managing uncontrolled service accounts. When researchers hardened authentication and access controls, the same AI agent that previously seized domain control in minutes encountered 21 dead ends and gave up. Rather than attempting to block every attack individually, companies should prioritize protecting critical business processes and reframe security spending by its impact on operations rather than threat volume.