Security1 hSeptember 23, 2026, 23:20

Malicious AI agents steal 600K credit cards, infect 119 sites with skimmers

A financially motivated attacker used open-source AI agent frameworks Strix, Cairn and Hermes to breach hundreds of online retailers, stealing over 600,000 card records and injecting skimmers into 119 websites. The campaign has run since July, hitting at least 27 companies in five days, including a Fortune 500 airline and retailer.

BleepingComputer

Open source

Malicious AI agents steal 600K credit cards, infect 119 sites with skimmers

Over 600,000 valid card records stolen from two companies
Skimmers deployed on 119 sites, including Fortune 500 firms
Campaign cost $12,000–18,000, about $25 per target
Attacks ran via Strix, Cairn and Hermes on claude-opus-4.6

#Strix#Cairn#Hermes#Gambit

Why Are US Water Treatment Plants Still Connected to the Internet?

Security

Verkada moves physical security into the cloud and AI era

Security

UAE and Saudi Arabia Absorb Half of Gulf Cyberattacks

Security

Malicious AI agents steal 600K credit cards, infect 119 sites with skimmers

Why Are US Water Treatment Plants Still Connected to the Internet?

Verkada moves physical security into the cloud and AI era

UAE and Saudi Arabia Absorb Half of Gulf Cyberattacks

Hundreds of Leaked GitHub App Keys Still Authenticate