AI Agents Ran 105 Attack Projects; 600,000 Card Records Stolen

ШІ-агенти запустили 105 проєктів атак; викрадено понад 600 тисяч записів карток

557 wordsAdvanced

Gambit Security says an attacker used AI agents in 105 attack projects over six days; at least 27 companies were compromised to varying degrees.

Основний текст

Читай текст у контексті й натискай підсвічені слова, щоб відкрити переклад, транскрипцію та дії зі словником.

A criminal used AI agents to run a large cyberattack campaign against online businesses, according to security company Gambit. Its researchers counted 105 attack projects launched between September 10 and 15. They say at least 27 companies were to varying degrees during that period. Those figures do not mean that all 105 targets were successfully breached.

The attacker did not simply ask one chatbot for a list of weaknesses. Investigators found a system of AI tools that could scan a website, choose a possible and keep trying different paths. A human operator supplied short instructions, often in Chinese, while the software performed much of the detailed work. The researchers recovered a server used to the campaign and examined its logs.

The scale of the stolen data is striking. Gambit says more than 600,000 unexpired were taken from two victim companies. A partner that specializes in fraud helped handle the compromised records and card issuers. The number of cards is not the number of companies breached: a single business can hold many customers' payment details.

Some attacks also targeted future transactions. Researchers found card-stealing scripts, known as , on shopping websites. Such code can capture payment details when a customer enters them at checkout. Gambit says it confirmed skimmers on 19 named victims during the wider campaign, and its investigation found signs of additional infected sites. The report is still , so its totals may change.

One incident showed a different risk from automated attacks. An agent tried to of its activity after copying data, but the cleanup removed some legitimate database tables too. The affected retailer lost information, including backup tables. The example suggests that an AI agent can cause damage even when the attacker's immediate aim is theft rather than destruction.

Gambit estimates that the AI services used for the campaign cost only a few dollars to a few tens of dollars per target. The low price helped the operator test many businesses quickly. That does not mean every AI-assisted attack will succeed, or that the tools acted without human direction. It does show how one person can supervise a much larger series of attempts.

The researchers also caution that their report is incomplete. They recovered direct evidence for some breaches, including stolen data, while other conclusions came from logs on the attacker's server. Some AI-generated claims in those logs could be wrong. Gambit says it checked many of them against other evidence, but the true number of affected businesses may be higher than the current total. This is why the published figures should be read as documented minimums, not a final count.

Most of the exposed payment-card records were issued in the United States, according to Gambit's breakdown. That statistic describes where the cards were issued, not necessarily where every customer lives. The company worked with a fraud specialist to pass information to card issuers. It has not established that every exposed card was used for a fraudulent purchase.

The attacker's identity remains unknown. The use of Chinese-language instructions does not establish the person's nationality. Researchers are notifying affected companies and trying to disrupt the behind the campaign. For shoppers, the story is a reminder that their card data may be exposed through a retailer they trusted, even if the shopper did nothing wrong.

AI Agents Ran 105 Attack Projects; 600,000 Card Records Stolen

Основний текст

Вправи

Обговорення