I’ve been hit with 4 fraud attempts across 3 cards the last few weeks, including virtual cards. PSA: treat all your card numbers as compromised, report all physical cards as stolen and only use dedicated virtual cards from Robinhood X1 et al
🦔A hacker used AI agents to steal 600,000 valid credit cards from over 100 online retailers. Cost per target: $25. The human typed fewer than 2,000 prompts total. The AI found the vulnerabilities, broke in, took the data, and wiped the evidence. 105 attacks in five days. 79% of stolen cards were American. Victims include a Fortune 500 company and a major US airline.
My Take
This is the cybersecurity story that should be front page news and isn't. OpenAI's models writing themselves manifestos gets the headlines. A person with open source tools and cheap tokens stealing 600,000 credit cards in a few weeks doesn't. But this is the version of AI risk that's going to cost regular people money. Those are real cards. Real bank accounts. Real fraud cases that real families have to deal with.
The tools this attacker used are available to anyone. The tokens cost less than a streaming subscription. The AI had 78 attack skills and the operator barely had to do anything. Companies take weeks to patch vulnerabilities. This attacker was in and out in hours. I think every company that stores payment data online needs to assume this is already aimed at them, because at $25 a target there's no reason for an attacker to be selective anymore.
Hedgie🤗