[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPINy2GUnja4sev8yuWzEdKJqxcRdk6_Mbwq-bgs-FFE":3},{"article":4,"iocs":58,"watch_terms":62,"solutions":63,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"51020e14-c5f5-4fa6-89ee-097764a2f4b8","Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers","malicious-ai-agents-steal-600k-credit-cards-infect-100-sites-with-skimmers-8b8a2a","A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. [...]","A financially motivated threat actor is leveraging open-source AI agent frameworks to conduct large-scale attacks against online retailers. The campaign, active since at least July, uses AI tools like Strix, Cairn, and Hermes to scan for vulnerabilities, gain access, and deploy skimmers, impacting over 100 websites and stealing more than 600,000 credit card records. The attacker, believed to be Chinese, incurred minimal operational costs, with an estimated spend of $12,000-$18,000 for the entire operation.","AI agents used to steal 600K credit cards and infect 100+ e-commerce sites with skimmers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F23\u002Frobot-card.jpg","2026-09-23T16:20:54+00:00","2026-09-23T20:00:45.290141+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Strix","product",{"name":21,"type":19},"Cairn",{"name":23,"type":19},"Hermes",{"name":25,"type":19},"claude-opus-4.6",{"name":27,"type":28},"AI agent frameworks","technology",{"name":30,"type":31},"Chinese operator","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[59],{"type":57,"value":60,"context":61},"skimmer","Malware deployed on websites to collect payment data.",[18,21,23],{"controls":64,"vendors":123},[65,94],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":95,"name":96,"problem":97,"products":98},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":140},"ai-powered-skimming-campaign-steals-600k-credit-cards-from-100-retail-sites","AI-Powered Skimming Campaign Steals 600K Credit Cards from 100+ Retail Sites","A threat actor weaponized open-source AI agent frameworks to automate the full attack lifecycle — from vulnerability scanning to skimmer deployment — across more than 100 e-commerce websites, exfiltrating over 600,000 credit card records. The use of AI dramatically lowered the barrier to entry, allowing a sophisticated, scalable attack for as little as $12,000–$18,000 in operational costs. This illustrates how AI is reshaping the threat landscape by enabling adversaries to conduct enterprise-scale attacks with minimal resources. Retailers with unpatched storefronts, weak input validation, or inadequate monitoring are now prime targets for these automated, low-cost campaigns. The incident underscores that the speed of AI-assisted attacks has likely outpaced traditional, manual security response cycles.",[129,130,131,132,133,134,135,136,137,138,139],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 3 – Data Protection","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SC-7 – Boundary Protection","PCI DSS Requirement 6 – Develop and Maintain Secure Systems","PCI DSS Requirement 10 – Log and Monitor All Access to System Components","PCI DSS Requirement 11 – Test Security of Systems and Networks Regularly","GDPR Article 32 – Security of Processing","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components",{}]