Open-source AI agent retail skimming campaign
Campaign
Summary
Hide ▲
Show ▼
A financially motivated threat actor is running an AI-agent-driven skimming campaign against online retailers, stealing payment card data at scale. The operation has been active since at least July and was still ongoing on September 22. In a five-day span it compromised at least 27 companies and launched 105 attack waves.
Related Happenings
Two companies' credit card records stolen in retail skimming operation
Data Leak
H score46
First: 23.09.2026 19:20
Last: 23.09.2026 19:20
Sources 1
How related:
the attacker stole more than 600,000 valid card details from two companies
About this happening:
A confirmed theft of more than 600,000 valid card details from two companies has expanded a payment-data exposure tied to a retail skimming operation. The records were tak...
Two companies' credit card records stolen in retail skimming operation
Data LeakHow related: the attacker stole more than 600,000 valid card details from two companies
About this happening: A confirmed theft of more than 600,000 valid card details from two companies has expanded a payment-data exposure tied to a retail skimming operation. The records were tak...
Timeline
-
23.09.2026 19:20 2 articles · 2h ago
AI agent skimming campaign steals 600,000 card records from online retailers
Initial DisclosureA financially motivated threat actor is running an AI-agent-driven campaign against online retailers, using Strix for scanning and vulnerability discovery, Cairn for autonomous exploitation, and Hermes for orchestration and post-exploitation control with claude-opus-4.6. Gambit says the operation has been active since at least July and was still ongoing as of September 22, with Strix running 146 times against 138 hosts between August 23 and 31 and the attacker launching 105 attack waves between September 10 and 15. The campaign has compromised at least 119 websites with credit card skimmers, stolen more than 600,000 valid card details from two companies, and reached organizations including a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor, and an online fashion retailer.
Show sources
- Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers — www.bleepingcomputer.com — 23.09.2026 19:20
- Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers — www.bleepingcomputer.com — 23.09.2026 19:20