[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvTH094ZYrNLV0nVo6Ll6zojpElOVWogsBOsFF7Mn6dg":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e467383d-b150-43a5-8aea-91f5db07f2b2","AI-Powered Campaign Targets Hundreds of Online Retailers","ai-powered-campaign-targets-hundreds-of-online-retailers-f074e0","A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration. The post AI-Powered Campaign Targets Hundreds of Online Retailers appeared first on SecurityWeek.","A financially motivated, Chinese-speaking threat actor is leveraging three AI agents for an ongoing campaign against online retailers. The campaign, active since July, uses AI for vulnerability research, exploitation, and attack orchestration, leading to the compromise of at least 27 companies and the theft of over 600,000 credit card records. The attackers also injected skimmer scripts into multiple online stores.","AI-powered campaign targets hundreds of online retailers, stealing credit card data.","https:\u002F\u002Fwww.securityweek.com\u002Fai-powered-campaign-targets-hundreds-of-online-retailers\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002Fdark-web-marketplace-credit-card.jpeg","2026-09-24T12:48:14+00:00","2026-09-24T14:00:12.379799+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Chinese-speaking threat actor","threat_actor",{"name":21,"type":22},"Strix","product",{"name":24,"type":22},"Cairn",{"name":26,"type":22},"Hermes",{"name":28,"type":29},"AI agents","technology",{"name":31,"type":29},"OpenRouter","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"malware","skimmer scripts","Injected into online stores' checkout pages.",[21,24,26],{"controls":62,"vendors":150},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":122,"name":123,"problem":124,"products":125},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"ai-driven-threat-actors-compromise-27-retailers-steal-600k-credit-card-records","AI-Driven Threat Actors Compromise 27 Retailers, Steal 600K Credit Card Records","A Chinese-speaking threat actor weaponized three AI agents to automate vulnerability research, exploitation, and attack orchestration against online retailers, compromising at least 27 companies since July. The attackers injected skimmer scripts into e-commerce storefronts, resulting in the theft of over 600,000 credit card records — a clear indicator that unpatched vulnerabilities and insufficient runtime monitoring of web assets were left unaddressed. This campaign highlights how AI is lowering the barrier for sophisticated, multi-stage attacks, enabling threat actors to scale operations that previously required significant manual effort. The financial and reputational damage to affected retailers — along with potential GDPR and PCI-DSS liability — underscores why proactive vulnerability management and real-time integrity monitoring are no longer optional for any business processing payments online.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST CSF DE.CM-4 – Malicious Code Detection","PCI-DSS v4.0 Requirement 6 – Develop and Maintain Secure Systems","PCI-DSS v4.0 Requirement 11 – Test Security of Systems and Networks","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","OWASP Top 10 A08:2021 – Software and Data Integrity Failures",{"GDPR Article 32 – Security of Processing":169,"NIST CSF DE.CM-4 – Malicious Code Detection":170,"CIS Control 16 – Application Software Security":171,"CIS Control 13 – Network Monitoring and Defense":172,"NIST SP 800-53 SI-3 – Malicious Code Protection":173,"CIS Control 7 – Continuous Vulnerability Management":174,"GDPR Article 33 – Notification of a Personal Data Breach":175,"NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning":176,"OWASP Top 10 A08:2021 – Software and Data Integrity Failures":177,"PCI-DSS v4.0 Requirement 6 – Develop and Maintain Secure Systems":178,"NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity":179,"PCI-DSS v4.0 Requirement 11 – Test Security of Systems and Networks":180},"Protecting card and personal data is part of Article 32's appropriate measures.","Malicious code detection helps catch skimmers injected into checkout pages.","Application security includes protecting e-commerce code from script injection.","Network monitoring helps detect card data being sent to skimmer domains.","Malicious code protection helps detect skimmer scripts on storefronts.","Continuous vulnerability management would close the store flaws the AI agents found and exploited.","Theft of 600,000 card records requires breach notification within 72 hours.","Vulnerability scanning helps find store flaws before AI-driven attackers do.","Integrity failures, such as accepting altered scripts, are what let skimmers run on storefronts.","PCI DSS Requirement 6 covers secure development and patching of payment systems, reducing exploitable flaws.","Integrity checks on storefront scripts would detect the injected skimmers.","Requirement 11 includes detecting changes to payment pages, which would catch skimmers."]