origo.hu · Techbázis ·
AI Attack: More Than 600,000 Bank Card Data Stolen According to Gambit Researchers
Since July 2026, an AI-based attack series has placed bank card data‑stealing code on at least 119 websites, and from two companies' data more than 600,000 valid cards were obtained. The operation required autonomous decisions by AI agents, significantly reducing the cost of cyber attacks.
Gambit cybersecurity researchers discovered that since July 2026 an AI-based attack series successfully placed bank card data‑stealing code on at least 119 websites. The attack acquired more than 600,000 valid, unused bank cards from two companies' data.
The attackers used three open-source AI agents: Strix examined targets and searched for security vulnerabilities; Cairn attempted to gain access by exploiting them; Hermes played a controlling role, independently deciding the next steps. The AI agents performed part of the tasks autonomously, so the attacker did not have to manually execute every operation.
To acquire card data, malicious JavaScript code was used and payment pages were modified. According to Gambit, among the affected websites were a Fortune 500 hospitality company, a major American airline, and a significant industrial supplier.
Using AI proved cost‑effective: within four weeks the account associated with the artificial intelligence models cost about $7,000, while the total operation AI cost ranged between $12,000 and $18,000. Reviewing a single target averaged $25.46, the cheapest case was $3.13, and the most expensive was $79.31.
This discovery highlights that AI agents can automate tasks previously performed by humans, significantly increasing the efficiency of cyber attacks and reducing their costs.
Source: https://www.origo.hu/techbazis/2026/09/ai-tamadas-600-ezer-bankkartya-adatait-szereztek-meg