ARTEX AI Hacking Platform Fuels Autonomous Cybercrime Campaigns
Cybercriminals are leveraging the open-source AI-powered hacking platform ARTEX for autonomous vulnerability discovery and exploitation, with over 1,800 exposed instances identified.
AI-powered agentic hacking platforms are rapidly transforming the cybercrime landscape, enabling threat actors to automate complex attack chains with minimal human intervention. One such platform, ARTEX, designed initially for legitimate penetration testing, has been co-opted by malicious actors to conduct autonomous vulnerability discovery and exploitation. Check Point Research has identified a significant proliferation of this tool, with over 1,800 ARTEX instances exposed to the public internet, indicating a massive scale of deployment by cybercriminals.
The ARTEX platform utilizes large language models (LLMs) to coordinate multiple AI agents. These agents are capable of planning tests, executing security tools, and gathering evidence of potential vulnerabilities. The platform's web dashboard provides a centralized view of assets, testing progress, captured traffic, and findings, allowing operators to monitor and direct their AI fleets. While ARTEX was originally developed as an open-source tool to aid security professionals, its developer made the project closed-source in October 2026 following its observed use in attacks against South Korean banks. However, various forks and backups of the original repository ensure its continued availability to threat actors.
Analysis of operator consoles reveals that most ARTEX-driven attacks are fully autonomous after the initial goal is set by the user. Threat actors exhibit minimal interaction with their agent fleets, primarily checking progress rather than actively managing individual operations. This level of automation allows for attacks to be carried out at unprecedented speed and scale, significantly lowering the technical barrier to entry for aspiring cybercriminals. The prevalence of Chinese LLMs, particularly the Deepseek Flash family, has been noted, with operators often switching to more permissive Chinese models when American models, like Anthropic's Opus 5.5, hit guardrails.
The goals set by attackers using ARTEX are almost exclusively focused on opportunistic, financially motivated cybercrime. These operations are typically broad in scope rather than targeting a single entity. Agents commonly abuse web vulnerabilities, such as Remote Code Execution (RCE), to gain initial access. In some observed cases, the access gained through these automated attacks has been leveraged to actively conduct supply chain attacks, further amplifying their impact.
Check Point Research's investigation uncovered several distinct campaigns orchestrated by ARTEX operators. One notable campaign focused on compromising gray-market certificate marketplaces that distribute Apple iOS code-signing certificates. The objective was to steal these certificates, which are valuable for signing iOS applications and sideloading them outside the App Store, and then resell them. The operator in this instance ran two ARTEX consoles in parallel for approximately two weeks, utilizing Deepseek v4.1 Flash and Kimi K3.1 Pro models.
Other observed campaigns included efforts to acquire cryptocurrency, steal gaming accounts, and launch Denial-of-Service (DoS) attacks against gambling websites. To circumvent security measures like Web Application Firewalls (WAFs) and IP blocking, many operators configured their agents to use residential proxies, with one operator even developing a dedicated skill for proxy management. The ease with which these agents can be deployed and managed underscores the growing threat posed by AI-driven cybercrime.
The widespread availability of ARTEX and similar agentic hacking frameworks presents a significant challenge for cybersecurity defenders. The ability for attackers to launch sophisticated, automated attacks with minimal technical expertise and oversight means that the threat landscape is evolving rapidly. Organizations must remain vigilant and adapt their defenses to counter these increasingly autonomous and scalable cyber threats.