The operation relies on AI agents to automate and scale what would traditionally require significant manual effort, from reconnaissance through to the deployment of malicious scripts on victim sites. According to the reporting, the campaign targets e-commerce platforms at scale rather than focusing on individual merchants, allowing the actor to harvest card data from many victims simultaneously.

Key points from the reporting:

• The threat actor is financially motivated and leverages open-source AI agent frameworks as part of their tooling.
• More than 600,000 credit card records were stolen.
• Over 100 sites were infected with skimmer code.
• The scale of the operation points to heavy automation across the attack lifecycle.

The use of AI agent frameworks marks a notable shift in how skimming campaigns can be executed, lowering the effort required to identify and compromise large numbers of retail sites while maintaining a high volume of stolen payment data.

Source: BleepingComputer

Has your organization reviewed its payment page scripts for unauthorized modifications in light of automated skimming campaigns like this?