AI-Driven Threat Actors Compromise 27 Retailers, Steal 600K Credit Card Records
A Chinese-speaking threat actor weaponized three AI agents to automate vulnerability research, exploitation, and attack orchestration against online retailers, compromising at least 27 companies since July. The attackers injected skimmer scripts into e-commerce storefronts, resulting in the theft of over 600,000 credit card records — a clear indicator that unpatched vulnerabilities and insufficient runtime monitoring of web assets were left unaddressed. This campaign highlights how AI is lowering the barrier for sophisticated, multi-stage attacks, enabling threat actors to scale operations that previously required significant manual effort. The financial and reputational damage to affected retailers — along with potential GDPR and PCI-DSS liability — underscores why proactive vulnerability management and real-time integrity monitoring are no longer optional for any business processing payments online.
Tactical Insight
Immediate actions
- Deploy a Web Application Firewall (WAF) in front of all e-commerce storefronts and tune rules to detect and block skimmer injection attempts.
- Conduct an emergency audit of all third-party scripts and payment page code to identify unauthorized or tampered JavaScript.
- Apply all outstanding patches to e-commerce platforms, plugins, and dependencies immediately, prioritizing internet-facing components.
Detection measures
- Implement real-time file integrity monitoring (FIM) on web server directories to alert on unauthorized script modifications.
- Enable Content Security Policy (CSP) headers to restrict which scripts are permitted to execute on payment and checkout pages.
- Deploy automated vulnerability scanning and continuous attack surface monitoring targeting all public-facing retail infrastructure.
Long-term improvements
- Adopt a PCI-DSS compliant payment architecture, including tokenization and point-to-point encryption, to minimize the value of intercepted card data.
- Establish a formal third-party/supply chain review process to vet all integrated scripts, plugins, and e-commerce extensions before deployment.
- Build an AI-aware threat intelligence program that monitors emerging adversarial AI tactics and updates detection rules accordingly.