Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

Threat actors are using three open-source AI agent frameworks (Strix for scanning, Cairn for exploitation, and Hermes for coordination) to automatically attack hundreds of online retailers, stealing over 600,000 credit card records and injecting skimmer malware (code that secretly captures payment card data) onto 119+ websites since at least July. The attacker gives the AI agents high-level instructions and lets them execute attacks autonomously at scale, with an average cost of only $25 per target and success rates varying across at least 27 compromised companies including major retailers and airlines.