# AI agents stole 600,000 payment records from online shops, for about $25 a target

> Gambit says autonomous AI agents breached dozens of online shops since July, planting card skimmers that stole 600,000 payment records for about $25 each.

HisnLabs Security & Research Team (HisnLabs) · Published 2026-09-26
Canonical: https://hisnlabs.com/en/news/ai-agents-card-skimming-600000-cards

Since July 2026, an attacker has directed autonomous AI agents to break into retail websites, plant card skimmers on their checkout pages and collect payment data, the security firm Gambit said in research [TechRadar reported](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware) on 24 September. Gambit says it recovered the operator's staging server and rebuilt the campaign from its logs and the skimmers it found live on victim sites. At least 600,000 payment records have been stolen, and Gambit said the campaign was still running when it published its findings.

## Background

A web skimmer is a script planted on a shop's own checkout page. It copies a card number as a customer types it, before the shop's payment processor ever sees the card, and it needs no access to the customer's own device. The technique predates AI and has traditionally required a human attacker to find a vulnerable site, break in and install the script by hand, one target at a time. What Gambit describes is the same result produced largely by AI agents that plan an attack, exploit a site and clean up after themselves, which changes how many sites a single operator can reach in a given week [[1]](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware).

## Findings

Gambit says the operator used three AI "harnesses", frameworks that can carry out most of an attack chain without a person directing each step. Hermes, an open-source autonomous agent with persistent memory and a web console, served as the operator's own orchestration console; on the staging server Gambit examined, it had loaded a Chinese-language system persona built from 121 skills, 78 of them offensive. Hermes ran on Anthropic's opus-4.6, after newer models refused its requests, directed by 1,951 short prompts typed in Chinese across 260 sessions. A second tool, Cairn, an autonomous penetration-testing engine, took a target domain and an objective such as gaining a shell, then ran until it succeeded, timed out or was stopped; it used DeepSeek's v4.1 Flash model. A third, Strix, is an open-source AI penetration-testing tool. One of the tools chose targets from a website-ranking service, favouring sites running custom-built software [[1]](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware).

In five days alone, 10 to 15 September, the agents ran 105 attack waves and compromised 27 organisations "to varying degrees", Gambit said. It named categories rather than companies: a Fortune 500 hospitality company, a "major" US airline, a large US industrial-supplies distributor and a US online fashion retailer. Where access was achieved, it usually took less than a day, sometimes only a few hours, and in some breaches the agents ran clean-up steps that deleted data on the target's own systems [[1]](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware).

Over four weeks the operator spent around $7,000, Gambit estimated, putting the campaign's total cost so far at no more than $18,000. Across 101 completed scans, the mean cost per target was $25.46, ranging from $3.13 for the cheapest to $79.31 for the most expensive. Gambit described the operation as more patient, persistent and inventive than most human attackers sustain, and said many of the affected organisations have since been notified and the skimmers removed [[1]](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware).

> Stolen card numbers are only useful once they leave a machine. Try FireAI free for 17 days and see, app by app, where your Mac sends data. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download)

## Implications for Mac users

The skimmer runs on the retailer's website, not on a shopper's computer, so this campaign says nothing about the security of any particular device. A shopper on a fully updated, carefully used Mac can still have a card number copied if the checkout page they are typing into has been compromised; there is no local warning sign to watch for. What agentic automation changes is cost and scale rather than the mechanism itself: Gambit's own figures put a full attack at well under $100 per target, and a lower price per attack means more shops get targeted, not that any single shop becomes vulnerable in a new way [[1]](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware).

## Recommendations

1. Use a payment method that does not hand the shop your real card number, such as Apple Pay or a virtual card number from your bank.
2. Turn on instant transaction alerts in your banking app, so a charge you do not recognise reaches you within minutes rather than at the end of the month.
3. Check your statements regularly and report anything you do not recognise straight away.
4. Be more cautious on small or unfamiliar shops running custom-built checkout software; Gambit said the attackers’ tooling favoured exactly those sites.

## Relevance to FireAI

This attack happens on a retailer's own servers, and a firewall running on a customer's Mac cannot reach that far. FireAI does not inspect the pages a browser loads or the scripts a shop runs inside them, and it is not a defence against this specific campaign.

Where FireAI is relevant is the other side of the same trend. The harnesses Gambit describes are ordinary software, and AI agents built the same way are starting to run on personal computers, not only on attackers' servers. FireAI asks before any new app or agent on a Mac connects to the internet for the first time, shows every destination on the [world map](https://hisnlabs.com/fireai/en/docs/world-map), and in [Under attack mode](https://hisnlabs.com/fireai/en/docs/security-modes) allows only apps a person has explicitly approved to connect at all. The AI it uses to explain a connection runs on the Mac itself.

> AI agents are moving from attackers’ servers to ordinary computers. Try FireAI free for 17 days and decide which apps and agents may reach the internet from yours. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download)

## Limitations

This account comes from one security firm's reconstruction of an operator's staging server and logs, and it has not been independently corroborated here. Gambit names categories of victims rather than the companies themselves, so the full scale of the campaign beyond the 27 organisations it studied in detail over five days is not established. Gambit described the campaign as still active when it reported its findings; the TechRadar account does not say whether it has since been stopped, or by whom.

Try [FireAI, by HisnLabs](https://hisnlabs.com/fireai/en/download) free for 17 days.

## Sources

- [TechRadar (Sead Fadilpašić), 24 September 2026: Massive Chinese hack uses AI agents to steal over 600,000 credit cards and hit hundreds of sites with malware](https://www.techradar.com/pro/security/massive-chinese-hack-uses-ai-agents-to-steal-over-600-000-credit-cards-and-hit-hundreds-of-sites-with-malware)