INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ArTEX AI Pentesting Tool Used in Data Theft Attacks

| 2026-10-08 14:12 HIGH MEDIUM AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
A targeted campaign using the recently released open-source agentic penetration testing tool ARTEX, developed in China, carried out attacks on South Korean financial organizations from late September to early October 2026. The attack is believed to be driven by a suspected Chinese-speaking operator with financial gain as their motive and has resulted in data exfiltration. The campaign was discovered after identifying open directories hosted at a Hong Kong-based IP address, exposing ARTEX configuration files among other sensitive information. The attackers used a two-server architecture, with the Hong Kong-based IP address hosting an instance of ARTEX suspected to be behind the attacks; this ARTEX instance utilized DeepSeek v4.1-flash as its main LLM backend and Z.ai's GLM-5.3 and SpaceXAI's Grok 4.6 for supplementation.
Technical Mitigations AI-generated
• Block or hunt for the IP address "38.244.50[.]120" and its associated ARTEX instance using DeepSeek v4.1-flash, Z.ai's GLM-5.3, and SpaceXAI's Grok 4.6. • Use a LLM API reseller like "@<a href="/auth/login?next=/detail/SuwxH6EBAhlSTKR_3ZAi" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>." to detect potential misuse of the LLM backend. • Monitor for suspicious activity related to vulnerability research on Telegram-based NFT gift marketplaces using the username "YY520CN" or "YY". • Implement measures to prevent unauthorized access to ARTEX configuration files and session histories.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
xc•••••.pro
38.244.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
HK KR BR CN
Incident Timeline
‎2026/10/08
Threat actors used the ARTEX AI pentesting tool to carry out data theft attacks on South Korean financial firms from late September to early October 2026.
organisation LLM
Analysis of the Claude Code sessions from the Hong Kong IP address has revealed a two-server architecture - The Hong Kong-based IP address functions as the backbone of the campaign The IP address "38.244.50[.]120" hosts the ARTEX instance suspected to be behind the attacks on Korean attacks The ARTEX instance has been found to use DeepSeek v4.1-flash as the main LLM backend, while usin…
organisation SpaceXAI
Analysis of the Claude Code sessions from the Hong Kong IP address has revealed a two-server architecture - The Hong Kong-based IP address functions as the backbone of the campaign The IP address "38.244.50[.]120" hosts the ARTEX instance suspected to be behind the attacks on Korean attacks The ARTEX instance has been found to use DeepSeek v4.1-flash as the main LLM backend, while usin…
organisation OpenAI
…h employs an AI agent with an anti-detection browser to bypass defenses that detect automation Exfiltrating successful credentials in the format "✅ {url} {user}:{password}" to a private Telegram channel While OpenAI's GPT-5.6 is used for dork generation (aka search queries) to find authentication pages of companies in a specific sector, GPT-5.5 is used for target classification and rating.
‎October 2026
A financially motivated, Portuguese-speaking actor dubbed SCARLET LOOP used ARTEX AI pentesting tool to conduct credential stuffing and account takeover attacks on South Korean financial firms.
organisation ARTEX
"In this activity, the threat actor leveraged ARTEX, a recently released open-source agentic penetration testing (pentesting) tool developed in China, alongside large language models (LLMs)," the cybersecurity company said .
organisation CrowdStrike
CrowdStrike said it discovered the campaign after it identified a set of open directories hosted at a Hong Kong-based IP address, exposing Claude Code session histories, Claude memory files, and ARTEX configuration files.
organisation IP
CrowdStrike said it discovered the campaign after it identified a set of open directories hosted at a Hong Kong-based IP address, exposing Claude Code session histories, Claude memory files, and ARTEX configuration files.
organisation Google Gemini
Also configured are Anthropic's Claude Opus 4.6, Google Gemini 2.5 Flash, and GLM-5.1 models, with Google's gemma-4-26B-A4B set up as a local model served at "127.0.0[.]1:1237." "An LLM agent with 46 automation tools drives an instrumented Firefox that spoofs canvas, WebGL, time zone, language, geolocation and viewport, with outsourced captcha solving.
organisation Google
Also configured are Anthropic's Claude Opus 4.6, Google Gemini 2.5 Flash, and GLM-5.1 models, with Google's gemma-4-26B-A4B set up as a local model served at "127.0.0[.]1:1237." "An LLM agent with 46 automation tools drives an instrumented Firefox that spoofs canvas, WebGL, time zone, language, geolocation and viewport, with outsourced captcha solving.
organisation WebGL
Also configured are Anthropic's Claude Opus 4.6, Google Gemini 2.5 Flash, and GLM-5.1 models, with Google's gemma-4-26B-A4B set up as a local model served at "127.0.0[.]1:1237." "An LLM agent with 46 automation tools drives an instrumented Firefox that spoofs canvas, WebGL, time zone, language, geolocation and viewport, with outsourced captcha solving.
organisation SCARLET LOOP Uses AI for Account Takeover
" SCARLET LOOP Uses AI for Account Takeover The development comes as ZenoX disclosed details of an agentic credential stuffing and account takeover platform orchestrated by a financially motivated, Portuguese-speaking actor dubbed SCARLET LOOP.
organisation Telegram
In one Claude Code session, the threat actor is said to have fed a prompt that referenced a Telegram account named " @YY520CN " and the name "YY."
organisation NFT
Other sessions related to vulnerability research on a Telegram-based NFT gift marketplace have also used the same Telegram username.
organisation Target
The entire process unfolds in four steps - Target discovery and qualification, which involves finding high-value targets using an AI classifier.
organisation The Hacker News
The agent finds the login page, fills in the form and classifies the result," the Brazilian cybersecurity company said in a report shared with The Hacker News.
data_breach 12,277,358 credentials
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
data_breach 11,832 credentials
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
infrastructure 3,968 domains
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
Tactical Metrics
Metrics
data_breach
12,277,358
Credentials
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
Metrics
data_breach
11,832
Credentials
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
Metrics
infrastructure
3,968
Domains
" Analysis of the internet-exposed server hosting the platform has revealed that 12,277,358 credentials were tested, out of which 11,832 credentials have been classified as valid across 3,968 domains.
Intelligence Sources
The Hacker News 2026-10-08