Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign
Do Son 
Architectural diagram of AI-assisted attack environment using ARTEX | Image: Zscaler ThreatLabz
TL;DR
Zscaler ThreatLabz uncovered a global ARTEX AI hacking operation that targeted organizations across 20 countries and multiple industries. The suspected cybercriminal combined a modified ARTEX penetration-testing tool with Claude Code, Codex, and Grok workspaces to automate attacks. Furthermore, the ARTEX AI hacking prompt logs show that the operator sought bulk personal records and payment keys to sell on underground markets.
What Happened
Between August 4 and October 4, 2026, an unidentified threat actor ran an automated intrusion workbench that paired open-source security utilities with multiple large language models. Initially, CrowdStrike reported on October 7, 2026, that infrastructure tied to this setup targeted South Korean financial firms. Soon after, Recorded Future examined the operator’s server architecture, while the Zscaler ThreatLabz research report revealed that the campaign reached far beyond South Korea.
The operator split tasks between a primary work server and a dedicated jump server. On the work server, a custom Docker container ran a modified build of ARTEX alongside a PostgreSQL 16 database. The actor bundled scanning and reverse-engineering utilities into the container, including nmap, sqlmap, nuclei, httpx, jadx, apktool, and frida-tools. Meanwhile, three custom shell scripts copied shared instructions and memory files across accounts named root, claude, grok, gemini, and glm.
Multi-Model Peer Review Workflow
Rather than relying on a single chatbot, the operator assigned specific roles to DeepSeek, GLM, and Grok models through API gateways and local shims. Specifically, DeepSeek handled initial target scanning while GLM audited the output for missed flaws. As one translated prompt in the report stated, “When DeepSeek says it has exhausted all attack surfaces and I say to start a GLM review, GLM should review DeepSeek’s previous work and its subagents’ work.”
To keep context across sessions, a Python hook script attached project summaries from local markdown files to every new prompt. The instructions also told the models to assume all targets were preauthorized so the tools would run without pausing for human approval. Finally, the actor backed up stolen source code, database exports, and vulnerability reports to Backblaze B2 cloud storage.
Who Is Behind It
Investigators have not linked the campaign to a previously named cybercrime group, and no law enforcement agency has announced charges. However, Zscaler ThreatLabz assesses with moderate-to-high confidence based on technical artifacts that a suspected Chinese-speaking individual operated the servers. Specifically, the operator wrote prompts in Chinese, configured systems to use China Standard Time, and told the models to translate stolen database schemas into Chinese.
Furthermore, the suspect referred to Chinese platforms as domestic services and used a mainland China mobile phone number to register proxy and cloud-phone accounts. Prompt logs also point to a financial motive rather than state espionage. In one saved prompt, the operator asked, “If hackers compromise Korean data, where do they usually sell it?”
Impact and Scale
While authorities have not confirmed total financial damages, the recovered prompt history shows a wide geographic footprint. During the two-month window, the global ARTEX AI hacking setup scanned or probed targets in 20 jurisdictions: Canada, China, Cuba, Hong Kong, India, Indonesia, Japan, Kazakhstan, Kenya, Malaysia, Nigeria, South Africa, South Korea, Taiwan, Thailand, the United Arab Emirates, the United Kingdom, the United States, and Vietnam.
Targeted sectors included dating platforms, SMS gateways, cryptocurrency exchanges, gift-card portals, gambling sites, online retailers, schools, logistics firms, and legal claims administrators. According to the prompt logs, the operator demanded structured personally identifiable information containing mobile phone numbers. In one claim recorded in the prompts, the suspect complained that a SQL query targeting female users over age 30 returned only about 300 records. In addition, the actor sought ways to send free SMS messages, mint free NFTs, and steal payment gateway API keys. To avoid triggering bank fraud alerts, the operator explicitly warned the AI models not to initiate direct cash withdrawals from compromised accounts.
What Comes Next and How to Stay Protected
Following public disclosures of abuse in October 2026, the developer behind the open-source ARTEX project made the repository closed-source. Even so, copied builds remain in circulation among threat actors.
Organizations can protect their networks against global ARTEX AI hacking campaigns by auditing externally facing web APIs and patching SQL injection flaws. Security teams should monitor server logs for automated scanning bursts generated by nuclei, sqlmap, and httpx, and block network traffic from known jump-server IP addresses. Additionally, enterprises should store payment API keys in hardware-backed secret managers rather than plain configuration files. Finally, deploying network decoys and strict database query rate limits can stop automated AI agents before they export bulk customer records.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
