Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

Criminals use ARTEX AI to steal gaming logins and signing certificates

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Check Point found live ARTEX consoles used to steal Honor of Kings credentials and Apple signing certificates; forks remain after the project closed.

Check Point Research reported that criminals are using ARTEX, a Chinese AI penetration-testing platform, to run largely autonomous, financially motivated attacks after setting an initial goal. Researchers counted 2,557 hosts running ARTEX panels, 1,608 of them live and public, and ten misconfigured instances that exposed operator databases. In cases detailed by later reports citing Check Point, agents collected more than 190,000 Honor of Kings credential sets—about 3.3 percent, roughly 6,000, still valid—and more than 300 gray-market Apple code-signing certificates, three of which still worked. One certificate-theft operation, from October 14 to October 29, used Deepseek v4.1 Flash and Kimi K3.1 Pro and processed about 36 billion tokens. The developer closed the original project on October 8 after earlier use against South Korean banks, but forks remain public.

Key facts
  • 2,557 ARTEX hosts found; 1,608 live and public; 10 exposed databases.
  • More than 190,000 Honor of Kings credentials taken; about 6,000 still worked.
  • More than 300 Apple signing certificates collected; three still validated.
  • Certificate run used about 36 billion tokens, including 2.13 billion uncached.
  • Live servers: 882 in the US, 295 in Hong Kong, 103 in China.
  • Gaming run hit 13 servers over five days, estimated cost $180–$360.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 8, 2026Developer closed the original ARTEX project · Check Point Research
  2. Oct 14, 2026Operator started two certificate-theft consoles · Check Point Research
  3. Oct 29, 2026Certificate-theft consoles ended after heavy token use · Check Point Research
  4. Nov 5, 2026Check Point published ARTEX campaign findings · Check Point Research
  5. Nov 6, 2026Follow-up reports added credential and certificate counts · Cyber Security News

What each outlet adds

beyond the shared facts
  • Check Point ResearchConsole census, 36 billion tokens, project closure, and a model switch.
  • Cyber Security NewsWorking-credential rate, server geography, failed crypto theft, and S3 restore.
Vendors
Apple
Products
ARTEXHonor of Kings
Malware
PZZCyberStrikeCairnPentAGIARTEX
Organizations
Check Point ResearchCheck Point
Countries
ChinaSouth KoreaUnited StatesHong Kong
AI models
Deepseek FlashDeepseek v4.1 FlashKimi K3.1 ProOpus 5.5DeepSeek v4.1 Flash

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Check Point ResearchFirst report

    Criminals run autonomous ARTEX agents for broad cybercrime

    Check Point found 1,608 live public consoles and ten exposed databases; one operator burned 36 billion tokens stealing signing certificates.

  2. · 5d ago GBHackers

    AI Agents Target Gaming Accounts and Apple Certificates

    ARTEX agents stole 190000 Honor of Kings credentials and 300 signing certificates from gray-market shops.

  3. · 5d ago Cyber Security News

    ARTEX AI agents steal gaming logins and Apple certificates

    Check Point says agents took over 190,000 Honor of Kings credential sets; about 3.3 percent, roughly 6,000, still worked.