A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
About this summary. This is a short, independently written summary of an article first published by BleepingComputer. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/
Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Coding Agents Aren't Enough! Evaluating an Enterprise Security Brain for Agentic Cloud Investigations
arXiv:2609.30345v1 Announce Type: new Abstract: Cloud-security investigation is dominated by population tasks: which identities can read a data store, how many resources…
Subjects, Not Authors: The Authorship Hazard in Agentic Dataspaces
arXiv:2609.30614v1 Announce Type: new Abstract: Dataspace connectors decide whether a transfer may occur, not what the transferred value contains, tolerable for…
Prompt Injection Detection for Email Agents Through Attack Chain Modeling
arXiv:2609.30657v1 Announce Type: new Abstract: Large language model email assistants are particularly vulnerable to indirect prompt injection because untrusted email…
Werracle: Sub-Cent Intra-Block AI Reflex Oracles and Flash-Loan Circuit Breakers for EVM Smart Contracts
arXiv:2609.30719v1 Announce Type: new Abstract: Contemporary on-chain artificial intelligence (AI) encounters an intractable Von Neumann memory and latency wall. Storing…
Input-Layer Starvation: Why Per-Layer Pruning Breaks IoT Intrusion Detectors
arXiv:2609.30729v1 Announce Type: new Abstract: Intrusion detectors for small Internet-of-Things (IoT) devices are usually compressed by pruning and judged by overall…
XPhysICS: Cross-Physical-Domain Threat Grounding for Industrial Control Systems Security
arXiv:2609.30805v1 Announce Type: new Abstract: Industrial control system (ICS) threats documented for one plant can express cyber-physical effects relevant to another…