Malicious AI agents skim 600,000 cards from online shops

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, and has stolen more than 600,000 credit card records, according to a report published by BleepingComputer on 23 September 2026.

The report says the attacker has infected more than 100 sites with payment-card skimmers. Skimmers are pieces of code injected into a checkout page that quietly copy card details as shoppers type them in. The number of stolen records, over 600,000, suggests the campaign has been running long enough to harvest data from a large volume of transactions, although the report does not give a start date.

What makes the campaign notable is the tooling rather than the technique. According to the report, the attacker is relying on open-source AI agent frameworks to carry out the attacks. Agent frameworks are software packages that let a language model plan a task, call tools such as web browsers or shell commands, and repeat the loop without a human pressing the button each time. The same components that make them useful for legitimate automation make them useful for scanning and compromising many targets in parallel.

The report does not name the frameworks involved, the retailers affected, or the payment processors handling the compromised transactions. It also does not attribute the activity to a named group or country. No vendor has been identified as the source of a flaw in this case; the reported root cause is misuse of general-purpose tooling rather than a specific product defect.

For shop owners, the practical implication is that the volume of automated probing against checkout flows may be rising. Skimmer infections are usually invisible to customers, because the checkout page keeps working normally while the card data is copied. Detection typically depends on monitoring changes to the code served to browsers rather than on shopper complaints.

Cardholders whose details were taken through a skimmer generally have no way of knowing which site was responsible. The report does not say whether affected retailers have begun notifying customers, or whether any of the stolen records have appeared for sale.

The campaign is an early example of AI agents being used as an offensive workforce rather than as a target. Most reported agent security incidents so far have involved attackers manipulating someone else's agent, for instance through injected instructions hidden in web content. Here, according to the report, the agents belong to the attacker and are doing the work directly. The Agentic Times will update this story if further technical detail, indicators of compromise or a list of affected sites is published.