ARTEX (Product): news timeline & CVEs

ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

A suspected Chinese operator used the ARTEX AI pentest tool to steal data from South Korean financial firms.

CrowdStrike Intelligence reported a late September to early October 2026 campaign against South Korean financial organizations that used ARTEX, an open-source agentic penetration-testing tool from Chinese developer Autumn-27, together with LLMs, and resulted in data exfiltration. The activity, tied to a Hong Kong IP and a suspected Chinese-speaking financially motivated operator, used DeepSeek v4.1-flash as the main model with GLM-5.3 and Grok 4.6. Autumn-27 then closed-sourced ARTEX. Separately, ZenoX described SCARLET LOOP, a Portuguese-speaking actor’s agentic credential-stuffing platform that tested 12,277,358 credentials and validated 11,832 across 3,968 domains.

The Hacker News14:12 UTC · 7h agoThreat actor in the wild 4 sources

Chinese Hacker Deployed AI in Campaign Against South Korean Banks

A suspected Chinese attacker used ARTEX and Claude to breach South Korean banks and steal customer data.

CrowdStrike says a financially motivated, likely Chinese-speaking attacker used the open-source agentic tool ARTEX and Anthropic's Claude from late September to early October 2026 to find vulnerabilities and compromise South Korean financial firms. Attacker infrastructure used DeepSeek v4.1-flash as ARTEX's main model, plus GLM-5.3 and Grok 4.6, and Claude was asked to find Korean Telegram groups for selling stolen data. Shinhan Bank and Yegaram Savings Bank reported breaches affecting about 25,000 and 40,000 people. South Korea's Financial Services Commission warned customers on October 6 about phishing and loan scams.

Infosecurity Magazineupdated 14:12 UTC · 7h agofirst 11:00 UTC · 10h agoThreat actor in the wild 4 sources1

Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets

CrowdStrike says a financially motivated operator used agentic AI to breach South Korean banks and steal data.

CrowdStrike reported a financially motivated campaign, active from late September to early October 2026, that used the ARTEX penetration-testing platform and commercial large language models against South Korean financial organizations. Exposed infrastructure showed ARTEX backed by DeepSeek V4.1 Flash, with separate Claude Code sessions using Zhipu AI’s GLM-5.3 and Grok 4.6. Shinhan Bank reported roughly 25,000 customers’ personal information compromised, and KB Kookmin Bank reported 119 affected customers; a broader figure of nine banks is not confirmed for this operator. CrowdStrike has moderate confidence the unidentified operator is Chinese-speaking, and self-reported alias YY remains unverified.

GBHackersupdated 14:12 UTC · 7h agofirst 10:16 UTC · 11h agoThreat actor in the wild 4 sources

AI-powered hacking tools enabled a likely single attacker to breach multiple South Korean banks

A suspected lone attacker used AI pentest tool ARTEX to breach South Korean banks, stealing over 25,000 Shinhan records.

CrowdStrike reports that a suspected Chinese-speaking attacker compromised multiple South Korean financial institutions between late September and early October 2026 and stole large volumes of data. At Shinhan Bank alone, more than 25,000 records containing names, contact details, income, and credit limits were taken, according to newspaper Khan. The attacker used ARTEX, a Chinese open-source tool published on GitHub in July that automates penetration testing with DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Researchers also found Claude Code session logs showing searches for Telegram groups to sell stolen data, and South Korea's financial regulator and President Lee Jae Myung called for an investigation.

The Decoder09:24 UTC · 12h agoData breach in the wild 6 sources1

ARTEX

Timeline4 articles

Appears with

ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

Chinese Hacker Deployed AI in Campaign Against South Korean Banks

Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets

AI-powered hacking tools enabled a likely single attacker to breach multiple South Korean banks