---
id: "CMP-202611-57y43e"
kind: "campaign"
aliases: []
title: "Cybercriminals run the ARTEX AI hacking tool almost on autopilot to break into web apps and steal credentials, crypto and iOS signing certificates; 1,600+ live consoles (Check Point)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "ARTEX", "fixed": [], "ecosystem": "other"}, {"name": "Amazon S3", "fixed": [], "affected": "buckets with keys leaked by app APIs", "ecosystem": "aws"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T17:55:47+00:00"
updated_at: "2026-11-05T17:56:39+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-05T17:55:47+00:00"}]
exploit_sources: []
---

# Cybercriminals run the ARTEX AI hacking tool almost on autopilot to break into web apps and steal credentials, crypto and iOS signing certificates; 1,600+ live consoles (Check Point)

Check Point Research (5 Nov 2026) found 2,557 servers hosting or having hosted ARTEX, an AI agent pentest platform that its developer took private in October; forks keep it available. 1,608 were live and public (US 882, Hong Kong 295, China 103). Ten exposed their databases and show financially motivated, opportunistic operators who set a goal and let the agents run almost on their own, mostly on DeepSeek Flash and Kimi models, through residential proxies. From 14 to 29 Oct 2026 one operator broke into 10 grey-market iOS signing shops and stole 300+ .p12 certificates with passwords. Another tasked agents against 292 crypto payment domains, gambling sites, card shops, OTC desks and custody backends to drain USDT and swap deposit addresses. That attempt failed, but along the way an unauthenticated API leaked AWS S3 keys, and the agent overwrote an iOS app manifest.plist in a public bucket (the owner restored it). A third operator took about 190,000 Honor of Kings account logins (about 6,000 still valid) from 13 game account shops. Entry methods: admin passwords hardcoded in front-end JavaScript bundles, web APIs with no authentication, command injection, SSTI, IDOR and weak admin passwords. No new CVE. The named victims are grey-market and crypto sites, but Check Point warns that any internet-facing web app can get this kind of high-volume testing. This is separate from the VAPOR PANDA and Storm-0940 ARTEX activity.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:ARTEX affected range not listed fixed no fixed version listed
- aws:Amazon S3 affected buckets with keys leaked by app APIs fixed no fixed version listed

## How to check

- Look in web, WAF and firewall logs for traffic from Check Point's ARTEX console clusters: 38.11.173.1-125, 38.11.221.1-125 and 198.200.59.85-89 (AS54600 PEG TECH, version tag sco-fix2); 103.122.245.194, .198, .199, .204, .214, .215, .216, .217, .218, .219 (AS152918 Liberally Network, Thailand); 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 (AS36352 HostPapa, tag 0.3.15-pro.*). The agents work through residential proxies, so the attack traffic may come from other IPs.\n- Search front-end JavaScript bundles and HTML for hardcoded admin passwords and keys, and check for web APIs that answer without authentication.\n- Check for public files in the web root that hold credentials, and for API responses that return cloud keys such as AWS S3 credentials.\n- If you publish iOS apps or landing pages from S3: check the bucket's write permissions and look for unexpected changes to manifest.plist, .ipa or index.html files.\n- Look for long, steady, broad scanning of every endpoint (AI agent testing).\n- Hashes and attacker wallet addresses: not published.

## Fix

- Remove hardcoded credentials from front-end code, rotate any that were shipped, and require authentication on every web and admin API.\n- Rotate cloud keys that any API or web response has exposed, and make S3 buckets that serve downloads read-only to the public.\n- Patch command injection and template injection issues, and replace weak or default admin passwords.\n- Block or alert on the listed IP ranges, and rate-limit or challenge long automated scans.\n- If you hold Apple enterprise signing certificates, keep them and their passwords out of web-reachable databases, and revoke any that may have been exposed.

## Timeline

- 2026-11-05T17:55:47+00:00 analyst

## Documents

- [describes] Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Check Point Research) https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_