AI-driven credit card skimming: 600K cards stolen from 119 sites

A financially motivated campaign using open-source AI agent frameworks has compromised at least 119 retailer websites, stealing over 600,000 credit card records since July 2026. The operator spent an estimated $12,000 to $18,000 on the entire operation, or roughly $25 per targeted company. For AI builders, this is the first public case showing that autonomous agents can orchestrate credential theft at a cost low enough to make even small e-commerce sites viable targets.

How the AI-powered skimming campaign worked

The attacker used three AI tools in sequence. Strix handled reconnaissance, running 146 times against 138 hosts over nine days and accumulating 633 scanning hours. Hermes, configured with a "SOUL - Red Team Operator" persona and 121 attack-related skills, executed the exploitation and data theft. A human operator provided short instructions between autonomous runs. Between September 10 and 15, the AI launched 105 distinct attack waves, successfully compromising at least 27 companies.

Once inside a target, the agents deployed credit card skimmers using multiple methods depending on the victim's architecture: appending malicious code to legitimate JavaScript files, adding script tags to checkout pages or Google tag blocks, poisoning S3 or CDN content and server-side caches, modifying database fields, altering Kubernetes deployments, and setting up cron jobs to restore the skimmer after removal. The researchers at Gambit who uncovered the campaign gained access to the attacker's staging server and confirmed the tools and instructions.

Why this changes the threat model for builders

This campaign demonstrates that AI agents can automate the full attack chain at a cost that makes it viable for any financially motivated actor. The total spend was between $12,000 and $18,000, with some targets costing as little as $3.13 to scan. That is cheap enough to attack thousands of sites.

For product teams building e-commerce platforms, the implication is direct: AI driven credit card skimming is no longer theoretical. The attack methods used here are standard injection techniques, but automated and scaled by agents. If your platform uses Magento or custom checkout code, the cleanup routines in this campaign actively deleted payment data after exfiltration, causing operational disruptions and potential data loss at multiple retailers.

Practical steps for defenders

Monitor your JavaScript files and checkout page integrity. Set up alerts for any unauthorized changes to S3 buckets, CDN distributions, Kubernetes deployments, and cron jobs. The Hermes skill file that instructed the agent to "wipe the source fields in batches" after data extraction shows that cleanup scripts are now part of the attack, not just post-exploitation noise.

Also plan for data loss as a side effect. Gambit researchers warned that defenses should account for attackers destroying records during exfiltration. This is not a bug in the attack; it is a deliberate tactic to cover tracks.

Caveats to keep in mind

All details come from Gambit's investigation as reported by BleepingComputer and other sources. The 600,000-plus card figure covers two specific breaches; the full scale may be larger. The operator appears to be Chinese-speaking, but that attribution is based on researcher interpretation. The campaign was still active as of September 22, so these numbers may already be outdated. Costs are estimates based on an OpenRouter account and the operator's own scan records. No independent verification has been published.