Cybercriminals run the ARTEX AI hacking tool almost on autopilot to break into web apps and steal credentials, crypto and iOS signing certificates; 1,600+ live consoles (Check Point)

Check Point Research (5 Nov 2026) found 2,557 servers hosting or having hosted ARTEX, an AI agent pentest platform that its developer took private in October; forks keep it available. 1,608 were live and public (US 882, Hong Kong 295, China 103). Ten exposed their databases and show financially motivated, opportunistic operators who set a goal and let the agents run almost on their own, mostly on DeepSeek Flash and Kimi models, through residential proxies. From 14 to 29 Oct 2026 one operator broke into 10 grey-market iOS signing shops and stole 300+ .p12 certificates with passwords. Another tasked agents against 292 crypto payment domains, gambling sites, card shops, OTC desks and custody backends to drain USDT and swap deposit addresses. That attempt failed, but along the way an unauthenticated API leaked AWS S3 keys, and the agent overwrote an iOS app manifest.plist in a public bucket (the owner restored it). A third operator took about 190,000 Honor of Kings account logins (about 6,000 still valid) from 13 game account shops. Entry methods: admin passwords hardcoded in front-end JavaScript bundles, web APIs with no authentication, command injection, SSTI, IDOR and weak admin passwords. No new CVE. The named victims are grey-market and crypto sites, but Check Point warns that any internet-facing web app can get this kind of high-volume testing. This is separate from the VAPOR PANDA and Storm-0940 ARTEX activity.