AI-Powered Skimming Campaign Steals 600K Credit Cards from 100+ Retail Sites

A threat actor weaponized open-source AI agent frameworks to automate the full attack lifecycle — from vulnerability scanning to skimmer deployment — across more than 100 e-commerce websites, exfiltrating over 600,000 credit card records. The use of AI dramatically lowered the barrier to entry, allowing a sophisticated, scalable attack for as little as $12,000–$18,000 in operational costs. This illustrates how AI is reshaping the threat landscape by enabling adversaries to conduct enterprise-scale attacks with minimal resources. Retailers with unpatched storefronts, weak input validation, or inadequate monitoring are now prime targets for these automated, low-cost campaigns. The incident underscores that the speed of AI-assisted attacks has likely outpaced traditional, manual security response cycles.

Tactical Insight

Immediate actions

Audit all internet-facing e-commerce platforms for known vulnerabilities and apply patches or mitigations immediately.
Deploy file integrity monitoring on web server directories to detect unauthorized script injections or skimmer code.
Scan all active web pages for unauthorized third-party scripts using tools like Subresource Integrity (SRI) checks.

Detection measures

Implement real-time alerting on anomalous outbound data transfers from web servers, particularly to unknown or foreign IP addresses.
Enable Web Application Firewall (WAF) rules specifically targeting automated scanning patterns and common skimmer injection techniques.
Monitor server logs for high-frequency, systematic vulnerability probing consistent with AI-driven reconnaissance behavior.

Long-term improvements

Adopt a Content Security Policy (CSP) to restrict which scripts can execute on payment and checkout pages, limiting skimmer effectiveness.
Establish a regular vulnerability management program with automated scanning cadences aligned to PCI DSS requirements for cardholder data environments.
Implement network segmentation to isolate payment processing systems from general web infrastructure, reducing lateral movement risk.

Framework References

CIS Control 7 – Continuous Vulnerability ManagementCIS Control 13 – Network Monitoring and DefenseCIS Control 3 – Data ProtectionNIST SP 800-53 SI-3 – Malicious Code ProtectionNIST SP 800-53 RA-5 – Vulnerability Monitoring and ScanningNIST SP 800-53 SC-7 – Boundary ProtectionPCI DSS Requirement 6 – Develop and Maintain Secure SystemsPCI DSS Requirement 10 – Log and Monitor All Access to System ComponentsPCI DSS Requirement 11 – Test Security of Systems and Networks RegularlyGDPR Article 32 – Security of ProcessingOWASP Top 10 A06:2021 – Vulnerable and Outdated Components

Source

ThreatNoir coverageMalicious AI agents steal 600K credit cards, infect 100+ sites with skimmers Read originalMalicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

Heard on the podcastThreatNoir Morning Brief — September 24

PublishedSep 23, 2026