Researchers link AI-assisted retail attacks to stolen payment cards

A threat actor using open-source AI agent tools stole more than 600,000 valid credit card records from two companies, cybersecurity startup Gambit found, according to BleepingComputer. The researchers also found payment-card skimmers on websites belonging to five other organizations and said the campaign remained active as of September 22. The tools scanned targets, pursued access and coordinated attacks after brief instructions from a human operator. Gambit reported 105 attack waves between September 10 and 15, with varying degrees of success against at least 27 companies. Researchers also found instructions to erase card data from Magento databases after theft, a step they said disrupted several retailers.