ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
CrowdStrike uncovers a campaign targeting South Korean financial firms using ARTEX AI pentesting tool, resulting in data exfiltration. ARTEX is now closed source after misuse.
Intelligence analysis by Qwen 2.5 (3B)
CrowdStrike identifies a threat actor using ARTEX, an AI pentesting tool, to carry out data theft attacks on South Korean financial firms. ARTEX is now closed source.
A bad guy used a tool called ARTEX to steal information from banks in South Korea. Now the tool is closed, and another bad guy is using AI to take over people's accounts.
Analysis
{"
ARTEX Background and Development":"ARTEX is an open-source agentic penetration testing tool developed by Autumn-27, designed for learning and research purposes. It uses large language models (LLMs) like DeepSeek, Z.ai, and SpaceXAI to conduct security tests.","
Campaign Details":"The threat actor used ARTEX to conduct data theft attacks on South Korean financial firms, including Shinhan Bank and Yegaram Savings Bank. The campaign was active from late September to early October 2026.","
ARTEX Misuse":"The misuse of ARTEX led to the exposure of sensitive data, including Claude Code session histories and ARTEX configuration files. The threat actor accessed DeepSeek via the LLM API reseller 'xcai[.]pro'.","
SCARLET LOOP Campaign":"A separate campaign, orchestrated by a Portuguese-speaking actor dubbed SCARLET LOOP, uses AI for account takeover. The platform automates the entire process, from target selection to credential execution, and supports multiple LLMs for different tasks."}
Key points
- ARTEX was used for data theft attacks on South Korean financial firms
- ARTEX is now closed source to prevent misuse
- Another threat actor is using AI for account takeover
- Misuse of AI tools can lead to data breaches and account takeovers
The misuse of ARTEX and similar tools can be prevented by better security practices and stricter regulations.
If misuse continues, more sensitive data could be at risk, and new AI tools could be developed for malicious purposes.
