Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

ARTEX AI hacking tool stays exposed and abused after shutdown

7 sources · 10 articlesFirst reported Updated ()5
What's new

November 7: Microsoft says Cambodia-based Storm-3358 used ARTEX against Southeast Asian finance; Hunt.io traced servers but says the Korean-bank link is unconfirmed.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ARTEX remains widely exposed and abused after its original project closed, including finance, cloud, gaming and certificate theft.

ARTEX, a Chinese open-source AI penetration-testing framework released in July 2026, remains available through public forks after the original project was closed. Researchers tied exposed consoles to South Korean bank breaches affecting about 66,000–67,000 people and 2,200 companies, and to a ConnectWise cloud intrusion, though Hunt.io says its Korean link is not confirmed. Check Point counted 2,557 ARTEX hosts, 1,608 live, while Censys-linked reporting cited 1,465 exposed consoles; TechCrunch reported more than 800 passwordless deployments. Observed abuse included gaming-credential and Apple signing-certificate theft and, according to Microsoft, Cambodia-based Storm-3358 attacks on Southeast Asian finance in October. Models cited include DeepSeek, Grok, Kimi and Claude.

Key facts
  • Closure dated October 8 by Check Point and October 11 by Cyber Security News.
  • Seven South Korean banks; about 66,000–67,000 people and 2,200 companies cited.
  • Check Point: 2,557 hosts, 1,608 live, and 10 exposed databases.
  • Censys-linked reports: 1,465 consoles, including 650 in identical blocks.
  • More than 190,000 Honor of Kings credential sets stolen; about 6,000 still worked.
  • Over 300 Apple certificates taken; three validated; one run used 36 billion tokens.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 8, 2026Developer closed the original ARTEX project, Check Point says. · Check Point Research
  2. Oct 11, 2026ARTEX framework reported taken down. · Cyber Security News
  3. Oct 14, 2026Certificate-theft operator began running two consoles. · Check Point Research
  4. Nov 4, 20261,465 ARTEX hosts reported exposed. · GBHackers

What each outlet adds

beyond the shared facts
  • Check Point ResearchLive-host census, token volume, certificate and gaming theft cases.
  • Microsoft Security BlogStorm-3358 in Cambodia targeting Southeast Asian financial organizations.
  • Security AffairsHunt.io traced servers but does not confirm the Korean link.
  • TechCrunchMore than 800 passwordless consoles; ARTEX plans to go closed-source.
  • Infosecurity MagazineAttributes one operation to Storm-0940 and details Censys co-hosting.
Vendors
CrowdStrikeGeniansHunt.ioMicrosoftAppleGenians Security CenterAutumn-27South Korean banksCensysCheck PointCERT-In
Products
ArtexARTEXHonor of KingsConnectWise CloudScopeWeaverARTEX PROCyberStrikeAIPentAGIHexStrike AIRedAmon
Threat actors
ARTEX hackersChinese-speaking lone operatorStorm-3358Chinese-speaking individualStorm-0940Chinese-speaking actorARTEXCrafty Falcon
Malware
PZZCyberStrikeCairnPentAGIWISPvshellAdaptixC2ARTEX
Victims
South Korean financial institutionsConnectWisefinancial organizations in Southeast AsiaSouth Korean financial organizationsConnectWise Cloud customersSouth Korean banksfinancial and cryptocurrency organizations
Organizations
CensysMicrosoftCrowdStrikeCheck Point ResearchCheck PointCensys Advanced Research Collective
Countries
South KoreaHong KongChinaCambodiaUnited States
AI models
Claude Code 2.1.221DeepSeekGLMGrokDeepseek FlashDeepseek v4.1 FlashKimi K3.1 ProOpus 5.5ARTEXDeepSeek v4.1 FlashGLM 5.3Grok 4.6

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    ARTEX hackers use AI tools to attack South Korean banks

    Threat actor used Claude Code, DeepSeek and Grok to target South Korean banks, stealing data

  2. · 4d ago Cyber Security News

    ARTEX Hackers Expose Servers Revealing AI Tools in South Korean Bank Breaches

    Hackers left servers open exposing ARTEX framework with Claude Code DeepSeek GLM and Grok models used in breaches affecting 66,000 to 67,000 people and 2,200 companies across seven South Korean banks.

  3. · 3d ago Check Point Research

    Criminals run autonomous ARTEX agents for broad cybercrime

    Check Point found 1,608 live public consoles and ten exposed databases; one operator burned 36 billion tokens stealing signing certificates.

  4. · 3d ago GBHackers

    ARTEX AI Framework Exposed on 1,465 Servers Linked to Bank Breaches

    The framework was used in South Korean bank breaches and ConnectWise Cloud supply-chain attacks.

  5. · 3d ago GBHackers

    AI Agents Target Gaming Accounts and Apple Certificates

    ARTEX agents stole 190000 Honor of Kings credentials and 300 signing certificates from gray-market shops.

  6. · 3d ago Infosecurity Magazine

    ARTEX AI tool used in more campaigns than reported, Censys finds

    Censys analysis reveals 1465 exposed ARTEX consoles worldwide, with 10.6% also running other threat artefacts.

  7. · 3d ago Cyber Security News

    ARTEX AI agents steal gaming logins and Apple certificates

    Check Point says agents took over 190,000 Honor of Kings credential sets; about 3.3 percent, roughly 6,000, still worked.

  8. · 2d ago TechCrunch · Security

    Censys finds over 800 Artex AI hacking tools exposed online

    Passwordless Artex consoles also expose implants, and prior uses include Korean finance and a ConnectWise intrusion.

  9. · 2d ago Microsoft Security Blog

    Storm-3358 uses ARTEX against financial sector

    Cambodia-based Storm-3358 cluster deploys agentic AI framework ARTEX to scan exploit and install RATs in financial organizations across Southeast Asia.

  10. · 1d ago Security Affairs

    ARTEX AI hacking tools linked to South Korean bank breaches

    Hunt.io traced ARTEX servers and AI tools used in breaches affecting 66,000 to 67,000 people and 2,200 corporations.