Stolen LLM API keys used to fund ARTEX credential-theft agents
Original title: Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft
Amazon’s MadPot honeypots captured ARTEX agent memory from October 3 to November 5; a separate deepfake KYC effort failed.
Amazon Threat Intelligence says financially motivated operators used the open-source ARTEX agent framework between October 3 and November 5, 2026. MadPot sensors impersonating LLM APIs captured prompts, tool histories, and campaign records. Agents targeted AI gateways and chat platforms holding upstream provider keys, then reused stolen keys to keep searching. A second effort tried real-time deepfakes against cryptocurrency-exchange KYC checks; documented attempts failed server-side verification.
Unconfirmed: Amazon could not independently verify outcomes described in agent-generated records.
- Amazon rates ARTEX use and Chinese-nexus attribution at moderate confidence.
- The playbook cites Langflow CVE-2025-3248 and RAGFlow CVE-2026-28797.
- Credential-theft address 104.28.225[.]223 was seen October 17–19.
- Crypto-fraud address 212.107.28[.]51 was seen on October 14.
- One deepfake came within seven pixels; every documented attempt failed.
Impact: Stolen LLM API keys reused to fund further credential theft
| Product | Affected |
|---|---|
| Langflow | — |
| RAGFlow | — |
- 1.Remove default credentials and patch exposed AI gateways and chat platforms.
- 2.Rotate leaked secrets and restrict management and inference endpoints.
- 3.Correlate listed campaign IP addresses with authentication and cloud audit logs.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2026-28797 | RAGFlow: In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text… | 8.7 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.142.140.158 | ign 1 212.107.28[.]51 IPv4 2026-10-14 2026-10-14 Campaign 2 103.142.140[.]158 IPv4 2026-10-17 2026-10-17 Campaign 2 104.28.251[.]98 IPv |
| ipv4 | 104.28.219.97 | ign 2 104.28.251[.]99 IPv4 2026-10-18 2026-10-18 Campaign 2 104.28.219[.]97 IPv4 2026-10-18 2026-10-18 Campaign 2 125.103.213[.]41 IP |
| ipv4 | 104.28.225.223 | ate unexpected model spending. Published indicators include 104.28.225[.]223 for credential theft and 212.107.28[.]51 for cryptocurren |
| ipv4 | 104.28.251.98 | n 2 103.142.140[.]158 IPv4 2026-10-17 2026-10-17 Campaign 2 104.28.251[.]98 IPv4 2026-10-18 2026-10-18 Campaign 2 104.28.251[.]99 IPv |
| ipv4 | 104.28.251.99 | ign 2 104.28.251[.]98 IPv4 2026-10-18 2026-10-18 Campaign 2 104.28.251[.]99 IPv4 2026-10-18 2026-10-18 Campaign 2 104.28.219[.]97 IPv |
| ipv4 | 125.103.213.41 | ign 2 104.28.219[.]97 IPv4 2026-10-18 2026-10-18 Campaign 2 125.103.213[.]41 IPv4 2026-10-18 2026-10-19 Campaign 2 Note: IP addresses |
| ipv4 | 128.242.115.131 | gn 1 150.136.38[.]110 IPv4 2026-10-31 2026-10-31 Campaign 1 128.242.115[.]131 IPv4 2026-10-31 2026-10-31 Campaign 1 216.176.239[.]231 I |
| ipv4 | 150.136.38.110 | aign 1 31.22.91[.]156 IPv4 2026-10-14 2026-10-19 Campaign 1 150.136.38[.]110 IPv4 2026-10-31 2026-10-31 Campaign 1 128.242.115[.]131 I |
| ipv4 | 212.107.28.51 | ndicators include 104.28.225[.]223 for credential theft and 212.107.28[.]51 for cryptocurrency fraud; organizations should correlate |
| ipv4 | 216.176.239.231 | n 1 128.242.115[.]131 IPv4 2026-10-31 2026-10-31 Campaign 1 216.176.239[.]231 IPv4 2026-11-02 2026-11-02 Campaign 1 212.107.28[.]51 IPv |
| ipv4 | 31.22.91.156 | tion 104.28.225[.]223 IPv4 2026-10-17 2026-10-19 Campaign 1 31.22.91[.]156 IPv4 2026-10-14 2026-10-19 Campaign 1 150.136.38[.]110 IP |
From the original article
3 min read at gbhackers.com
Chinese-nexus threat actors used ARTEX, an open-source agentic penetration-testing framework, to steal large language model API credentials and feed them back into infrastructure powering further attacks. Amazon Threat Intelligence uncovered the financially motivated campaigns after its MadPot decoy network captured requests containing the agents’ operational memory between October 3 and November 5, 2026.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.