You are connecting from Lake Geneva Public Library, please login or register to take advantage of your institution's Ground News Plan.
Published 2 days ago • loading... • Updated 5 hours ago
Malicious AI Agents Steal 600K Credit Cards, Infect 100+ Sites with Skimmers
Gambit Security said the campaign used AI agents to scan targets, plant skimmers and steal more than 600,000 card records for about $8,000.
Between September 10 and 15, a hacker used AI agents to compromise up to 100 companies, stealing more than 600,000 credit card records, according to Forbes.
The operation utilized Chinese AI models DeepSeek and Kimi alongside Claude Opus, spending around $8,000 total; three frameworks—Strix, Cairn, and Hermes—orchestrated the attack pipeline, per Cybersecurity News.
American cardholders accounted for approximately 488,000 stolen records, or about 79 percent of the total. Victims included a Fortune 500 hospitality firm, a major airline, and other enterprises across at least 27 compromised companies.
Anthropic banned the attacker's account, while Gambit Security partnered with Cloudflare and the Shadowserver Foundation to dismantle infrastructure. In two cases, the cleanup process accidentally erased victims' entire data, including backups.
Attacks remain ongoing as the attacker repeatedly rebuilds servers, according to Cloudflare. Eyal Sela, director of threat intelligence at Gambit Security, called it one of "the most severe abuses of AI for exploitation seen so far.
Chinese hackers have carried out a major cyberattack, using inexpensive tools. Reports indicate that Chinese hackers attacked more than 100 companies and stole over 600,000 credit card details.