ARTEX-Linked AI Hacking Targets Software Vendors and Identity Systems

Attackers used tooling associated with ARTEX, an autonomous AI penetration-testing framework, against multiple IT and software vendors, according to Wiz. The October campaign targeted application authentication and integrations with Okta, Microsoft Entra ID, AWS Cognito, and Microsoft 365 through reconnaissance, password spraying, account-recovery abuse, and attempts to bypass authentication and tenant isolation. Automated sessions lasted up to 30 hours and adapted to blocking and rate limits by switching IP addresses and endpoints. Most attempts failed. Infrastructure and techniques overlapped with activity Microsoft attributed to the Chinese-state-aligned actor Storm-0940, but Wiz did not definitively attribute all observed activity to that actor.

A separate Gurucul report described a global, cross-sector campaign combining customized ARTEX tooling, AI coding assistants, and automation scripts, with DeepSeek, GLM, and Grok coordinating reconnaissance and task execution. Prompt histories showed objectives including unauthorized access, credential and API-key theft, and exfiltration of personal and financial data; they did not establish that those objectives succeeded. Gurucul assessed possible financial motivation, rated the activity medium severity, and supplied nine IP indicators and a traffic-detection query. Together, the reports highlight persistent, adaptive automation rather than confirmed widespread compromise. Defenders should correlate authentication failures, recovery flows, and tenant-access anomalies across changing source IPs, using the published indicators alongside behavioral detections.