ARTEX Cyberattacks: AI Agents Steal Credentials and Signing Certificates

An exposed credential or unprotected API can give an AI agent an opening — and an attacker can leave it searching for the next one.

In a Nov. 5 report, Check Point Research documented criminals using ARTEX, an AI-powered penetration-testing framework, to automate attacks against multiple services. In observed incidents, these operators let the AI agents handle much of the work, with little further human involvement.

ARTEX was built for legitimate security testing, but its abuse shows how attackers can repurpose defensive tools. By reducing manual work, such frameworks could help attackers probe more systems with less ongoing effort.

What is ARTEX?

ARTEX is an AI-powered penetration-testing framework that helps cybersecurity professionals find and test security weaknesses in systems they own or have permission to assess.

Developed as an open-source project, it uses LLMs to coordinate multiple AI agents to plan security tests, conduct reconnaissance, test vulnerabilities, and document findings with limited human input.

In legitimate cybersecurity operations, this can save security teams considerable time.

However, the same capabilities that make ARTEX useful to penetration testers have attracted cybercriminals who have repurposed the framework for malicious purposes. In some cases, operators have done little beyond providing an initial attack objective, leaving the agents to plan and execute much of the operation themselves.

After reports of its use in cybercrime operations, ARTEX's developer made the original project closed-source. Still, this has not eliminated access to the framework, as existing copies, backups, and maintained forks remain publicly available, allowing others to keep using and modifying the tool.

How criminals have used ARTEX

The extent of this abuse becomes clearer in three campaigns documented by Check Point researchers. They found attackers using ARTEX against iOS app-signing providers, cryptocurrency-related services, and gaming-account marketplaces.

In one campaign, attackers targeted underground iOS app-signing services, which provide certificates for installing apps outside Apple's official App Store. 

According to Check Point, agents obtained more than 300 certificates and associated passwords. Three passed the validation checklist described in the report.

Another campaign targeted 13 gaming-account marketplaces. ARTEX agents found exposed files and poorly secured administrative interfaces, helping attackers obtain more than 190,000 Honor of Kings credentials. Sampling indicated that roughly 3.3% remained usable, suggesting about 6,000 accounts. That total was an extrapolation, rather than an individually verified count.

In a third campaign, attackers targeted 292 cryptocurrency-related domains, apparently seeking to steal USDT and alter payment configurations. The agents found exposed databases, vulnerable APIs, and personal information. 

One unauthenticated API exposed AWS credentials granting write access to an S3 bucket containing iOS app files, manifests, and landing pages. Agents successfully modified distribution assets, but the bucket owner later restored the original manifest. Check Point observed no funds reaching the attacker’s wallet; some agent-reported cashout successes were hallucinations based on API responses indicating success.

Chinese models, particularly the DeepSeek Flash family, predominated in the 10 analyzed instances. Check Point observed an operator switching models after encountering Opus 5.5 safeguards. These observations do not establish a general comparison of model safety.

ARTEX takes AI-assisted hacking a step further: orchestration

AI's use in cybercrime is not new. Criminals are already using it to write malicious code, generate phishing messages, automate reconnaissance, and support social engineering.

However, coordinating cyberattacks with AI still requires some level of technical know-how and setup. ARTEX further lowers that barrier by bringing multiple AI agents, language models, and hacking tools together under a single framework.

That is where its approach starts to resemble the plug-and-play kits already common in cybercrime. Such kits package tools and ready-made capabilities so criminals don't have to build or operate everything themselves.

Importantly, ARTEX was not developed as a cybercrime tool. It was built for legitimate penetration testing, helping security professionals assess systems they own or have permission to test. Its misuse shows how technology designed for defensive security work can be repurposed for unauthorized attacks.

What security teams should check now

ARTEX’s abuse gives security teams a practical reason to revisit their exposed attack surface. Prioritize weaknesses that let an external request become access to credentials, sensitive records, or software distribution systems.

Monitoring should connect activity across systems. Repeated endpoint probing followed by unusual administrative access, database retrieval, or cloud changes warrants investigation as a sequence.

If a compromise is found, address both the entry point and the access it enabled. Closing an exposed API does not invalidate credentials already taken, and restoring a modified download page does not establish whether users received altered content. Review access logs, revoke affected secrets, and investigate downstream exposure.

Organizations using security agents themselves should define authorized targets, limit available credentials, retain action logs, and require approval for disruptive operations. These controls help teams distinguish intended testing from unauthorized activity and verify what their agents changed.

The practical priority is reducing the paths from an exposed service to sensitive data or production changes. Assign owners to those paths, test the controls, and confirm that remediation removes the access an attacker could reuse.

Read more: Learn how CLOSEDQUORUM uses AI models to vote on attack actions — and which behaviors defenders can detect.