AI-Powered Campaign Targets Hundreds of Online Retailers
AI-powered campaign targets hundreds of online retailers, stealing credit card data.
A financially motivated, Chinese-speaking threat actor is leveraging three AI agents for an ongoing campaign against online retailers. The campaign, active since July, uses AI for vulnerability research, exploitation, and attack orchestration, leading to the compromise of at least 27 companies and the theft of over 600,000 credit card records. The attackers also injected skimmer scripts into multiple online stores.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Strix?
Get an email when a new story names Strix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Chinese-speaking threat actor weaponized three AI agents to automate vulnerability research, exploitation, and attack orchestration against online retailers, compromising at least 27 companies since July. The attackers injected skimmer scripts into e-commerce storefronts, resulting in the theft of over 600,000 credit card records — a clear indicator that unpatched vulnerabilities and insufficient runtime monitoring of web assets were left unaddressed. This campaign highlights how AI is lowering the barrier for sophisticated, multi-stage attacks, enabling threat actors to scale operations that previously required significant manual effort. The financial and reputational damage to affected retailers — along with potential GDPR and PCI-DSS liability — underscores why proactive vulnerability management and real-time integrity monitoring are no longer optional for any business processing payments online.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — skimmer scripts