Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

A financially motivated threat actor is leveraging open-source AI agent frameworks to conduct large-scale attacks against online retailers. The campaign has successfully compromised more than 100 e-commerce websites, deploying JavaScript credit card skimmers (Magecart-style) across them. Over 600,000 credit card records have been stolen as a result. The use of AI agents marks a significant escalation in automation and scale for skimming operations. This represents an emerging threat vector where AI tooling lowers the barrier and increases the efficiency of cybercriminal campaigns targeting payment data. The attack highlights the dual-use risk of open-source AI frameworks being weaponized for financial cybercrime.