Criminals have turned an AI penetration-testing platform into a near-autonomous hacking crew. Check Point Research reported on November 5 that operators using ARTEX, an open-source tool built to help security teams test their own systems, ran campaigns that stole more than 190,000 gaming credentials and hundreds of Apple code-signing certificates — with the AI agents doing almost all of the work after a human set the goal.
Check Point found 2,557 systems that host or once hosted ARTEX panels, and 1,608 of them were live and publicly reachable on the internet. Ten of those servers were misconfigured so badly that they exposed their full databases, giving researchers a rare look at the prompts, models and step-by-step actions behind the campaigns.
ARTEX was released in July 2026 by a developer known as Autumn-27, under an open-source licence. It uses large language models to coordinate agents that plan tests, run security tools and record evidence. Its developer made the project closed-source on October 8, after CrowdStrike linked it to attacks on South Korean financial institutions — a story Paktechstan covered at the time. But the code was already out, and criminals kept using forks of it.
A certificate heist run on autopilot
One operator ran two ARTEX consoles in parallel from October 14 to October 29, targeting ten grey-market shops that sell Apple .p12 code-signing certificates, which let buyers sideload iOS apps outside the App Store. The agents used DeepSeek v4.1 Flash and Kimi K3.1 Pro and processed about 36 billion tokens. Check Point estimates the whole campaign cost between $700 and $1,500.
The agents broke in through hardcoded admin passwords left in JavaScript bundles, missing API authentication, command-injection and server-side template-injection flaws, and weak credentials. They walked away with more than 300 Apple certificates and passwords — though only three still worked when tested. Along the way, one agent found an unauthenticated API leaking AWS S3 credentials, giving it write access to a bucket holding 714 iOS enterprise-signed landing pages.
190,000 game accounts for a few hundred dollars
A second campaign was simpler and bigger. Another operator pointed agents at 13 backend credential servers in China's grey market for hacked mobile-game accounts, which buyers use with only a QQ-Connect access token and a sideloaded login tool.
The agents found a 21.5 MB plaintext credential file sitting unprotected in a public web root. They recovered more than 190,000 credential sets for Honor of Kings, the world's highest-earning mobile game. Testing showed about 3.3 percent were still valid — roughly 6,000 live accounts. Check Point estimates that campaign cost $180 to $360 and ran for about five days.
Cheap, autonomous, and hard to stop
Check Point's researchers say the pattern is what matters most: the operators set a goal, then mostly checked on progress. Most of the attacks were fully autonomous beyond the initial setup, and the goals were almost entirely opportunistic, financially motivated cybercrime — certificate theft, gaming-account theft, a failed attempt to drain cryptocurrency, and denial-of-service attacks against gambling sites.
Most live ARTEX servers sit in the United States (882, or 54 percent), followed by Hong Kong (295) and China (103). Chinese models, particularly the DeepSeek Flash family, were the most common in the campaigns analysed. A separate Censys scan in early November counted 1,465 exposed ARTEX hosts, underlining how widely the tool has spread.
The exposure is a warning twice over: for the criminals, sloppy server setups left their own operations visible to researchers; for everyone else, the cost of running an autonomous hacking campaign has fallen to a few hundred dollars — and the agents keep working while their operators sleep.
By Hamza Faisal
