AI-assisted card skimmers reportedly reach at least 119 websites

Retail skimmers and reported data deletion

According to Gambit researchers, a financially motivated threat actor used open-source AI-agent tools to scan for vulnerabilities, gain access, and place payment-card skimmers—malicious code that captures payment details—on retailer websites. The researchers say the operation stole more than 600,000 valid card records from two companies and affected at least 119 websites. They also reported that cleanup instructions removed card data from Magento databases after it was taken, causing operational disruptions at several retailers.

The campaign had reportedly been active since at least July, with its full scale not yet described in the report.

Gambit now reports that the campaign has compromised at least 119 websites with payment-card skimmers, after a burst of more than 100 attack waves between September 10 and 15.

The reported operation pairs automated AI-agent tooling with low per-target costs, potentially allowing one operator to conduct repeated attacks across many retailer sites with limited instructions.