Over 600,000 credit cards stolen in cyber operation organized with AI agents
In a large-scale cyber operation targeting e-commerce sites, credit card information belonging to more than 600,000 cards was seized from two companies using autonomous artificial intelligence tools.
According to a cybersecurity report uncovered by Gambit Security, attacks have been carried out against hundreds of online stores since July using autonomous artificial intelligence agents and tools. As a result of these operations, at least 600,000 pieces of credit card information were stolen, and permanent damage occurred in some systems.
Scope and Process of the Attacks
Hundreds of online stores were targeted within the scope of cyber operations carried out since July 2026.
Between September 10 and 15 alone, 105 attacks took place and access was gained to the systems of at least 27 companies at varying levels.
Tools Used and Low Cost
The hacker utilized three different open-source tools in the attacks, and these tools autonomously handled most of the processes.
The average operational cost per target was recorded as only $25.46.
Data Theft and Malicious Code
Researchers detected that over 600,000 credit card records were stolen from two different companies.
Additionally, it was determined that malicious codes that directly collect card information were embedded into some e-commerce sites.
Deletion of Database Tables
The attacks were not limited to data theft alone, and the agents cleaned up to leave no trace behind.
During this process, 180 tables in the database along with backups created by company executives were completely deleted.