Malicious AI agents stole over 600,000 payment-card records and infected at least 119 websites with skimmers

A financially motivated threat actor used open-source AI agent frameworks to attack hundreds of online retailers. The campaign has been active since at least July and was ongoing as of September 22. The attacker stole more than 600,000 valid card records from two companies and deployed payment-data skimmers on the websites of five other organizations. In total, at least 119 websites were compromised with credit-card skimmers.