12 Million Stolen Logins Weaponized: SCARLET LOOP's AI Agents Hunted 6,171 Sites That Move Money

Twelve million, two hundred seventy-seven thousand, three hundred fifty-eight. That's how many stolen username and password pairs a single Portuguese-speaking crew pushed through login forms between February and September 2026, according to the Brazilian security firm ZenoX. Of those, 11,832 worked. The crew didn't hire a room full of operators to do it. It built a platform ZenoX calls SCARLET LOOP, where language models pick the victims, find the login pages, write the automation and then step aside.

ZenoX published its findings in late September. Brazilian outlets CISO Advisor and TI Inside covered them first, and The Hacker News ran a detailed English write-up on October 8. I've cross-checked the numbers below between CISO Advisor's Portuguese reporting and The Hacker News. Where they differ, I say so.

I've read a lot of "AI-powered attack" coverage this year, and most of it is a vendor describing a phishing email that was grammatically correct. This one is different. It's an operational platform, caught with its configuration exposed, and the most interesting thing in it isn't the AI. It's the bookkeeping.

The one question that picked 6,171 victims

Most credential stuffing starts with a combo list and a target the operator already cares about: a streaming service, a bank, a retailer. SCARLET LOOP inverts that. An operator describes a project in plain language. One model, which The Hacker News reports was OpenAI's GPT-5.6, turns that description into search engine dork queries designed to surface authentication pages in a sector. A second model, GPT-5.5, scores each result from 0 to 10.

CISO Advisor quotes the central criterion straight from the code: "o negócio movimenta dinheiro?" Does the business move money?

That's the whole targeting philosophy. Topic doesn't matter. Brand doesn't matter. If an account on your platform holds a balance, a credit, points or anything that converts to cash, you qualify. Over roughly six months the system evaluated 84,660 URLs and qualified 6,171 domains, spread across 47 sectors and 107 countries and territories. Five sectors made up 54% of those domains, and ZenoX's observation is that they share one trait: value sitting inside the user's account.

The project list kept growing while ZenoX watched. On September 4 the analyzed server held 47 discovery projects. A week later it held 55, with the classifier running live.

Why Brazilian loyalty programs went first

Brazil was the testing ground. In scans on April 28 and 29, the platform ran 136 sweeps against 89 domains and enumerated 27,460 subdomains. Of those 89 domains, 52 were Brazilian, mostly loyalty programs, corporate incentive platforms and gift card services. Later, 219 .br domains turned up among the qualified targets.

None of that surprises anyone who's worked fraud. Loyalty accounts are the softest money on the internet. Customers reuse the password they set in 2017. MFA is rare because product teams worry it'll hurt redemption rates. Nobody checks their points balance weekly, so a drained account can sit unnoticed for months. And corporate incentive platforms are worse: the "customer" is an employee who got a login from HR, used it twice, and forgot it existed. Akamai was flagging loyalty programs as a credential stuffing magnet back in 2020. The difference now is that the attacker no longer has to choose them by hand.

Four stages, one invoice

The Hacker News lays out the workflow in four steps. I find it more useful to read it as a cost structure, because that's clearly how the authors thought about it.

Stage one, discovery. The dork generator and classifier described above. Cheap per query, run at volume.

Stage two, credential acquisition. Target-specific credentials pulled from infostealer logs and data leaks. This is the part that costs the crew almost nothing, because the underground already did the work. Flashpoint counted 1.7 billion stolen credentials from 7.4 million infected hosts in the first half of 2026 alone. If your customers' laptops are in that pile, their logins for your portal are in it too, often with the exact URL attached.

Stage three, login execution. This is where the expensive models come in. An LLM agent with 46 automation tools drives an instrumented Firefox. The browser spoofs canvas and WebGL fingerprints, time zone, language, geolocation and viewport. Captcha solving goes out to a paid service. DeepSeek-V4-Pro and V4-Flash power the browser agent, per The Hacker News, with Claude Opus 4.6, Gemini 2.5 Flash and GLM-5.1 also configured, and a local Gemma model served on the box itself. CISO Advisor reports the platform supports up to 500 simultaneous workers.

Stage four, exfiltration. Every successful login goes to a private Telegram channel in a fixed format: a check mark, the URL, then user:password.

AUTO mode is the part to remember

Here's the design decision I keep coming back to. After a set number of successful logins against the same domain, SCARLET LOOP pulls the model out of the loop entirely. ZenoX calls this AUTO mode. The agent has already mapped your login flow, worked out where the fields are, how the captcha appears and what a successful response looks like. It has written purpose-built automation for your site. From that point, the platform just replays that automation against the rest of the credential list.

ZenoX's own summary is blunt: "Model reasoning is expensive and slow. The platform was built to pay for intelligence exactly once per target, and then stop paying."

Think about what that means for a defender. The adaptive, human-like, hard-to-fingerprint phase is short. It lasts until the agent racks up enough wins to trust its script. Everything after that is a deterministic replay, the same sequence of requests, at the same pace, against your login endpoint. The "AI attack" on your site is mostly a plain old bot that an AI wrote for you specifically.

That has two consequences. Bad news: it's cheap enough to point at thousands of mid-sized businesses that were never worth a human operator's time. Gabriel Paiva, ZenoX's CEO, told CISO Advisor that scale is what changes here, with AI letting the crew move across thousands of different companies at once. Good news: once AUTO mode kicks in, the attack stops adapting. If you can recognize the replay, it won't learn to dodge you, because nobody's paying for it to think anymore.

Do the math on the hit rate

11,832 valid out of 12,277,358 tested is a success rate of about 0.096%, roughly one in every 1,040 attempts. The Hacker News reports those valid credentials span 3,968 domains, which averages out to about three working accounts per breached site.

That ratio tells you a few things.

First, almost every attempt fails. Over a thousand failed logins for every success means the signal is there in your authentication logs if you're looking. ZenoX's main recommendation is exactly that: review your own authentication logs. It also warns that not appearing on the 6,171-domain list doesn't mean you weren't targeted. The list is what ZenoX could see on one server, and 11,832 is a floor, not a total.

Second, three accounts per site is small enough to slip under almost every volume-based alert. Nobody's fraud team pages on-call because three loyalty members out of 400,000 logged in from a new device. Those three accounts get drained, the customers complain weeks later, and the incident gets logged as "customer password reuse," which is technically true and completely useless.

Third, the failure rate is the attacker's main cost. Every failed attempt burns proxy bandwidth, captcha-solver credits and worker time. A platform built around "pay once, then stop paying" is very sensitive to anything that makes the replay phase more expensive or less trustworthy.

Where rate limits and bot scores lose this fight

I'll be direct about what doesn't work well against this design, because I see teams leaning on these controls and assuming they're covered.

Rate limiting per IP. A 500-worker pool behind residential proxies means each address makes a handful of attempts. You'll throttle your own customers on shared mobile carrier IPs before you throttle this.

Bot-score products alone. They're good at catching generic headless browsers. SCARLET LOOP drives a real Firefox with spoofed fingerprints, and a paid captcha service clears the challenge. During the discovery phase, an agent that's literally reasoning about your page is going to look more human than most scripts.

Breached-password checks at signup. Useful hygiene, but infostealer logs are fresh. The credential your customer typed yesterday on an infected laptop isn't in Have I Been Pwned yet.

Customer MFA. This is the real fix, and you should push it. But loyalty and incentive platforms rarely enforce it, and the business owner usually has a redemption-rate chart explaining why. You're going to be living with password-only accounts on these platforms for a while.

None of this means turn those controls off. It means none of them answers the one question that matters during a campaign like this: is the login I'm looking at right now coming from someone replaying stolen data?

Plant credentials only a thief can use

This is where deception changes the math, and it maps almost perfectly onto how SCARLET LOOP works.

The platform feeds on infostealer logs and leak dumps. It doesn't generate passwords, it consumes them. So the cleanest possible detector is a credential that exists in those sources and nowhere else. Create a set of customer accounts on your loyalty or incentive platform that no real person uses. Give them realistic names, realistic point balances, and passwords that have never been typed into your real login flow by an employee or customer. Then seed those credentials where stealer operators and leak brokers will pick them up, alongside the URL of your login page, which is exactly the format infostealer logs use.

Any login attempt against one of those accounts is malicious. There's no legitimate user who could produce it. No baseline to tune, no threshold to argue about, no "probably a customer on a VPN." I've written before about how the GTIG-tracked harvester checks every key it steals before the operator ever touches it. SCARLET LOOP does the same thing with consumer logins, and validation is the step where planted credentials fire.

The AUTO mode design makes this better, not worse. Consider the sequence:

1. The agent reaches your login page and starts testing. Your honey accounts are somewhere in its list, mixed in with real stolen pairs.
2. The first time one of them is tried, you get an alert with the source IP, the user agent, the browser fingerprint and the exact request sequence.
3. That request sequence is the agent's learned automation. Once AUTO mode takes over, every subsequent attempt from that campaign replays it.
4. You now have a fingerprint of the replay that you can match against every other login on the site, including the ones using real customers' stolen passwords.

One honey account trip gives you the shape of the whole campaign against your domain. That's the part volume-based detection can't give you, because by the time the volume is obvious, the three accounts that worked are already in a Telegram channel.

An edge case worth planning for

What if the attacker logs in successfully to the honey account? Let it. A decoy account with a modest, non-redeemable balance and no linked payment method costs you nothing. The Telegram message that goes to the crew is a check mark next to a credential you control. If you're watching what happens after login, you'll learn which pages the replay hits first, whether it checks balances or goes straight to redemption, and whether anyone comes back to that account by hand later. That's the difference between "we blocked a bot" and knowing exactly what the crew does with access.

There's a second, quieter benefit. A platform optimized to stop paying for intelligence trusts its own success signal. Every planted credential that "works" is a successful login that leads nowhere, and enough of those degrade the value of a target in the attacker's own scoring. I wouldn't promise that it gets you dropped from the target list, but it's the kind of friction this cost model is designed to avoid.

This pattern will spread past loyalty points

SCARLET LOOP is a Portuguese-speaking crew going after Brazilian gift cards first. Don't read that as regional. The same week The Hacker News covered it, CrowdStrike Intelligence reported a separate, Chinese-speaking operator using the open-source ARTEX agentic pentesting tool to steal data from South Korean financial firms, including Shinhan Bank and Yegaram Savings Bank. Two unrelated groups, two continents, the same idea: let a model do the reconnaissance and the first contact, then automate the rest.

The workforce version of this is already obvious. Swap "does the business move money?" for "does this tenant have a VPN portal?" and you have an agent that finds your SSO page and replays employee credentials from stealer logs, the exact attack surface behind the Chilean password spray that went after seven service accounts nobody owned. The defenses look the same too: decoy identities in your directory, honeytoken credentials in the places stealers harvest, and alerts that fire on use rather than on volume. That's the approach behind Mine2's deception solutions, and it works for the same reason here: the attacker's only input is stolen data, so stolen data you planted is the input you control.

If you run a loyalty, rewards, gift card or incentive platform, start with ZenoX's advice and pull your authentication logs for February through September. Look for low-volume clusters of successful logins on dormant accounts. Then ask whether you'd even know if three of your members were drained this week. If the honest answer is no, book a demo and we'll show you how planted credentials turn the next replay against your login page into an alert with zero false positives.