AI Agents Steal 600K Cards From 119 Sites

A financially motivated threat actor used open-source AI agent frameworks to compromise at least 119 websites with credit card skimmers since July, stealing over 600,000 valid card records. Between September 10 and 15, the attacker launched 105 attack waves, succeeding on at least 27 companies. The operation cost an estimated $12,000 to $18,000, about $25 per target. Victims include a Fortune 500 hospitality firm and a major US airline.