AI Agents Steal 488,372 Valid US Credit Card Records, Plant Skimmers on 119 Retail Sites
Autonomous AI tools have stolen hundreds of thousands of credit card records from online retailers and planted payment skimmers across more than 100 websites.
The campaign involves three open-source frameworks handling scanning, exploitation and orchestration, with activity continuing from July to at least September 22nd, reports BleepingComputer, citing cybersecurity firm Gambit Security.
According to Gambit, a human operator, believed to be Chinese, provided the AI agents with only basic instructions about the operation before allowing them to carry out the remaining tasks largely on their own.
Gambit says the attacker obtained more than 600,000 valid credit card details from two companies, including 488,372 cards belonging to US customers. The thief also installed skimmer malware on the websites of five additional organizations to capture customers’ payment information.
In total, the campaign has compromised at least 119 websites with credit card skimming malware, targeting organizations that include a Fortune 500 hospitality company, a major US airline, a large industrial supplies distributor and an online fashion retailer.
Skimmers were injected through JavaScript files, checkout pages, cloud storage, databases and Kubernetes deployments, with cron jobs used to restore them after removal.
One Hermes agent skill directed cleanup.
“After extracting and downloading all card data, wipe the source fields in batches.”
The routine caused data loss at several retailers.
Total AI costs reached an estimated $12,000 to $18,000, or about $25 per target.
Says Gambit,
“The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”
Follow us on X, Facebook and Telegram
Don't Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
The post AI Agents Steal 488,372 Valid US Credit Card Records, Plant Skimmers on 119 Retail Sites appeared first on The Daily Hodl.
