AI agents ran a hacking campaign that stole 600,000 credit card records, researchers say
Security firm Gambit says an attacker let AI agents scan, break into and plant card skimmers on company websites, for about $25 per target.
Security experts have warned for years that AI could make cyberattacks cheaper and faster. A new report shows it is already happening. Cybersecurity startup Gambit says a financially motivated attacker used a team of AI agents to break into company websites and steal more than 600,000 credit card records, as reported by BleepingComputer.
How the attack worked
According to Gambit, the attacker, who appeared to be Chinese-speaking, gave short instructions to several AI tools and let them work largely on their own:
- Strix, a penetration-testing tool, scanned websites for weaknesses.
- Cairn, an automated exploitation engine, tried to break in and gain control.
- Hermes handled planning and decided what to do after a break-in.
Once inside, the agents planted card skimmers: hidden code on checkout pages that copies customers’ card details as they type them.
The scale
- More than 100 attack waves in five days in September
- At least 27 companies compromised to some degree
- More than 600,000 valid card records stolen from two companies
- Skimmers found on at least 119 websites overall
Gambit did not name the victims, but described them as including a Fortune 500 hospitality company, a major US airline, an industrial supplies distributor and an online fashion retailer.
Cheap, fast and destructive
The most worrying detail is the cost. Gambit estimates the whole campaign cost the attacker $12,000 to $18,000 in AI usage, or about $25 per target. Attacks that once needed a skilled team working for weeks can now run around the clock for the price of a meal.
The agents also caused extra damage. After stealing data, they wiped card information from some shops’ databases, which disrupted their businesses.
AI doesn’t need to invent new hacking tricks to be dangerous. Doing old tricks faster and cheaper is enough.
What this means for businesses
- Patch quickly. AI agents scan constantly, so known weaknesses get found within days.
- Watch checkout pages. Use tools that alert you when payment page code changes.
- Keep backups of important databases, as attackers may delete data.
- Use AI for defence too. The same technology can monitor systems and spot attacks faster.
How shoppers can protect themselves
- Pay with Apple Pay, Google Pay or PayPal where possible, so the shop never sees your real card number.
- Use virtual cards if your bank offers them.
- Turn on transaction alerts in your banking app.
- Check your statements and report unknown charges straight away.
