Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.

The campaign has been active since at least July and is ongoing as of September 22. In just five days, the threat actor compromised at least 27 companies and launched more than 100 attacks.

Despite the broad targeting, findings from cybersecurity startup Gambit indicate that the attacker stole more than 600,000 valid card details from two companies and deployed skimmer malware on the websites of five other organizations to collect payment data.

The researchers say that the campaign is powered by three AI tools to execute the attack chain against tens of companies every day:

Strix ran 146 times against 138 hosts between August 23 and 31, accumulating 633 scanning hours, the researchers found.