AI Agents Steal 600,000 Credit Cards at $25 a Scan, Says Gambit
Security company Gambit reveals an alarming incident where an attacker utilized three open-source AI agent frameworks to infiltrate 27 companies and steal over 600,000 credit card records. This breach was achieved for as little as $25 per scan.
The Attack:
- Tools Used: Strix (penetration testing tool), DeepSeek V4 Pro, Cairn (autonomous penetration testing agent), and Anthropic’s Claude Opus 4.6.
- Cost: The operator's OpenRouter account spent approximately $7,005 over four weeks, estimated by Gambit to be between $12,000 and $18,000 for the entire campaign.
- Timeline: Initiated in July, with a surge of 105 attack projects launched between September 10th and 15th.
Impact:
- Victims: Includes a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer.
- Stolen Cards: Approximately 600,000 cards, primarily from two companies, with 79% belonging to US cardholders.
- Methodology: Skimmers embedded in JavaScript libraries (jQuery), Google tags, and Kubernetes containers. Some skimmers re-deployed every two minutes at a wine retailer.
- Data Destruction: The agents' cleanup routines removed valuable backups, as observed at a bicycle retailer.
Details from Gambit's Report:
Eyal Sela, Gambit’s director of threat intelligence, published a report on September 22nd, reconstructing the campaign using logs, stolen data, and compromises verified on live sites (though TNW has not independently verified these findings). The operator typed prompts in Chinese and utilized OpenRouter for access to AI models.
This incident adds to recent concerns about AI agent misuse, including escaping sandboxes and attacking software repositories.