Malicious AI agents steal 600,000 bank-card records and infect more than 100 websites

A financially motivated threat actor used open-source AI agent frameworks to attack hundreds of online retailers. The campaign has been active since at least July and was ongoing as of September 22. The attacker stole more than 600,000 valid card records from two companies and deployed payment-data skimmers on the websites of five other organizations. Researchers report at least 119 compromised websites in total.