Researchers tied 63% of historical authorization transactions to attacker-linked contracts and measured $2.36 million in losses.