AI-Powered Skimming Campaign Steals 488k US Credit Cards, Hits 119 Retailers
A sophisticated AI-powered attack has compromised over 119 online retailers, stealing hundreds of thousands of valid US credit card records and planting payment skimmers across multiple websites.
The campaign, which spanned from July to at least September 22nd, involved three open-source frameworks handling scanning, exploitation, and orchestration. According to Gambit Security, a human operator provided basic instructions before allowing the AI agents to carry out the remaining tasks largely on their own.
The attacker obtained more than 600,000 valid credit card details from two companies, including 488,372 cards belonging to US customers. Skimmers were injected through various means, including JavaScript files, checkout pages, cloud storage, databases, and Kubernetes deployments.
Gambit estimates the total AI cost for the campaign at between $12,000 to $18,000, or approximately $25 per target. The operator's own cost review also gives a similar figure, with a mean of $25.46 over 101 completed scans.