Malicious AI Agents Steal 600,000 Credit Cards

A financially motivated threat actor has stolen over 600,000 credit card details by employing open-source AI agents to launch large-scale attacks on hundreds of online merchants. These attacks have infected more than 100 websites that serve as platforms for distributing skimmers. The attacks utilize automated scripts capable of identifying vulnerabilities in the payment systems of the affected merchants. These scripts are designed to intercept credit card information during the checkout process without the customer noticing. The use of AI technology allows the attackers to continuously optimize their methods and adapt to security measures.

The security firm investigating the attacks reports that the attackers are specifically targeting small and medium-sized online merchants, which often have less robust security protocols. These merchants are particularly vulnerable to such attacks as they may lack the resources to regularly update or monitor their systems. The stolen credit card information is typically sold on dark online markets, where it can be used for fraudulent purposes. Experts estimate that the value of the stolen data on the black market could reach several million dollars. The attackers may also attempt to use the information for further attacks on other businesses or individuals.

The security community has reacted to the incidents with concern. Many experts warn that such attacks could increase in the future as the technology behind AI agents becomes more accessible. The use of AI in cyberattacks could significantly escalate the threat landscape, as attackers are able to change and refine their tactics more quickly. Some companies have already taken measures to protect their systems, including implementing multi-factor authentication and regularly reviewing security protocols.

Nevertheless, the challenge remains that many smaller merchants may not have the necessary resources to implement comprehensive security solutions. The incidents have also reignited the discussion about the need for stricter regulations in the field of cybersecurity. Some experts are calling for stronger regulation of online payment systems to ensure consumer safety. The introduction of standards could help minimize risks for online merchants and their customers. The attacks have also drawn the attention of law enforcement agencies, which are trying to identify and hold the perpetrators accountable.

However, investigations may prove difficult as the attackers often operate anonymously and cover their tracks on the internet. The complexity of the technologies used also complicates tracking the attackers. The security firm investigating the attacks plans to publish its findings in a comprehensive report detailing the methods and techniques of the attackers. This report could provide valuable insights for companies looking to enhance their security measures. The publication is scheduled for October 31, 2026.