AI agents stole 488,372 valid credit card records from U.S. customers and infected 119 websites with skimming malware. According to NS3.AI, the campaign ran from July to at least September 22.

Gambit Security said a human operator believed to be Chinese gave the agents basic instructions before they handled most of the tasks themselves.