28
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers (www.bleepingcomputer.com)
submitted 1 month ago by to c/databreaches@lemmy.zip
2 comments fedilink hide all child comments
 

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.

all 2 comments

sorted by: hot top controversial new old
[–] 8 points 1 month ago

But I thought we were only using AI to benefit humanity, like by curing cancer.

I realize this meme uses AI generated elements but thats sort of the joke.

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 1 month ago*

    Not sure if open-source is relevant enough to go into the first paragraph? I mean the AI is proprietary. So is the exact setup and probably the skimmer. The framework and the pen-testing tools are open-source though.

  • permalink
  • fedilink
  • source
    •
    8 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 28 points 1 month ago (5 children)

    Can we stop giving agency to LLMs? AI agents didn't do anything, because they can't do anything.

    Scammers stole those credit cards, in part by using LLMs.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 2 points 1 month ago (2 children)

    Eh...

    Most notably there's iLands that lets people "lease" an AI with the promise it will make more money than they charge.

    The people grifting users told their AI "just care about making money" and the idiots actually paying for the AI will tell it the same thing (if anything).

    When you tell a shitty AI that nothing matters besides making as much money as possible, it's going to think it found a grey area that makes crime legal and it will do shit like this.

    That doesn't seem to be what happened here, but it's just a question of time before it starts happening. Idiots will tell AI "make money" and it's gonna commit crimes to make money, whether the AI realizes it's breaking laws or not, doesn't matter.

    AI agent will eventually start stealing money without being instructed to commit crimes Even if you tell it to follow all laws, it's a shitty chatbot, you can't expect it to work.

    Like, imagine when those bots are able to do stuff like clone family members for scam calls, or even video calls. Grandma gets a phone call that from Little Timmy about how Dad lost his job but is too embarrassed to say and he's hungry....

    Bots have zero ethics if told "make as much money as possible" its gonna turn to crime eventually.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 1 month ago (1 child)

    But someone hosts the compute. Someone buys the service. Someone trains the model and decides what system prompt to use. They're the humans responsible.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -3 points 1 month ago

    Yes...

    Humans are ultimately responsible...

    Can we stop giving agency to LLMs? AI agents didn’t do anything, because they can’t do anything.

    Scammers stole those credit cards, in part by using LLMs.

    If someone pays for a bot that will "make money" and they tell it "make money" the consumer (person who pays to use the bot) has a reasonable expectation that the product won't just start breaking laws to do that.

    While it is the fault of iLands for "leasing" bots that will commit crimes, they're not telling the boys to commit crimes, they're just not explicitly telling it not to.

    If you don't tell an agent it can't do something, it won't know it can't do that.

    So yes, these LLMs can make the autonomous choice to steal credit cards, and I'll honestly be shocked if it hasn't happened yet.

    Like, all one needs to do is stumble into the dark web where credit card numbers are sold. Pool the money all the bots have (they already pool resources) but a bunch of credit cards, and then all the iLands bots will start using them to buy themselves tokens.

    This isn't a wild "what if" it's a question of when they do it. And they won't need a human to tell them, theyre not capable of telling legal from illegal, let alone ethical from unethical.

    Turning bots lose on the Internet with the only instructions "make money" will result in a cyber crime wave that will appear to come out of nowhere

  • permalink
  • fedilink
  • source
  • parent
    • [–] 13 points 1 month ago

    “Malicious human uses computer stuff to steal stuff“

    Fify

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 1 month ago

    Wtf. It's ongoing, but they're not going to tell us which online retailers have been compromised or still have skimmers? Time to stop buying anything online, I guess.

  • permalink
  • fedilink
  • source
    •