ARTEX AI agents steal gaming logins and Apple certificates
Original title: ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates
Check Point says agents took over 190,000 Honor of Kings credential sets; about 3.3 percent, roughly 6,000, still worked.
Check Point says criminals used ARTEX, an AI penetration-testing platform, with little human input to break into websites. In studied cases, agents stole more than 190,000 gaming credentials and more than 300 Apple code-signing certificates, of which three still worked. Entry came through hardcoded admin passwords, unauthenticated APIs, weak passwords, command injection, insecure direct object references, and server-side template injection. A separate attempt against 292 crypto payment domains did not move money to the attacker.
Unconfirmed: Token costs and the count of still-valid gaming accounts are Check Point estimates from its testing.
- Check Point found 2,557 ARTEX hosts; 1,608 were live, and 10 exposed full databases.
- An Apple-certificate run used Deepseek v4.1 Flash and Kimi K3.1 Pro and about 36 billion tokens.
- A gaming run against 13 servers lasted about five days and cost an estimated $180 to $360.
- Of live servers, 882 were in the US, 295 in Hong Kong, and 103 in China.
- One agent gained write access to an S3 bucket with 714 enterprise-signed iOS app pages; owners restored the manifest.
Impact: Stolen gaming credentials and usable Apple code-signing certificates
- 1.Find and rotate exposed secrets and remove hardcoded credentials from front-end code.
- 2.Require login on every API and test internet-facing systems.
- 3.Watch for sudden bursts of requests from automated agents.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.001 Credentials In FilesT1068 Exploitation for Privilege Escalation
- Vendors
- Apple
- Products
- Honor of Kings
- Malware
- ARTEX
- Organizations
- Check Point
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.122.245.194 | PEG TECH INC USA dev-db-resilience-20261031 (changing tag) 103.122.245.194, .198, .199, .204, .214, .215, .216, .217, .218, .219 10 AS |
| ipv4 | 104.168.112.237 | rolling slug) 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 5 AS36352 HostPapa USA Note: IP addresses and domains are i |
| ipv4 | 192.236.172.197 | Liberally Network LLC Thailand 0.3.15-pro.* (rolling slug) 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 5 AS36352 Hos |
| ipv4 | 198.200.59.85 | osts ASN Country sco-fix2 38.11.173.1-125, 38.11.221.1-125, 198.200.59.85-89 255 AS54600 PEG TECH INC USA dev-db-resilience-20261031 |
| ipv4 | 198.44.123.66 | k LLC Thailand 0.3.15-pro.* (rolling slug) 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 5 AS36352 HostPapa USA Note: |
| ipv4 | 204.44.66.81 | 0.3.15-pro.* (rolling slug) 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 5 AS36352 HostPapa USA Note: IP addresses |
| ipv4 | 38.11.221.1 | Addresses Total Hosts ASN Country sco-fix2 38.11.173.1-125, 38.11.221.1-125, 198.200.59.85-89 255 AS54600 PEG TECH INC USA dev-db-r |
From the original article
4 min read at cybersecuritynews.com
Cybercriminals are now using ARTEX, an AI-powered penetration testing platform, to break into websites with almost no human input. In the cases studied, the AI agents stole more than 190,000 gaming credentials and over 300 Apple code-signing certificates. Only three of those certificates still worked.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.