CampaignPublished 5 Nov 2026

Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns

Source Check Point Research

Description

ARTEX is an AI-powered autonomous hacking platform used by cybercriminals to conduct large-scale, financially motivated attacks. It leverages AI agents to discover and exploit web vulnerabilities such as Remote Code Execution (RCE) and conduct supply chain attacks with minimal human interaction. The platform, originally open-source, has been forked and remains publicly accessible despite being closed by its developer. ARTEX operators primarily use Chinese AI models and deploy attacks broadly, targeting various industries including gray-market code-signing certificate shops. Misconfigurations expose many ARTEX instances publicly, enabling remote access to administrative interfaces and operator data.

Impact

The autonomous nature of ARTEX enables threat actors to conduct rapid, large-scale exploitation of web vulnerabilities with minimal technical skill, increasing the volume and speed of opportunistic cybercrime. Compromises include theft of valuable assets such as iOS code-signing certificates, enabling malicious app signing and sideloading, and execution of supply chain attacks. The exposure of ARTEX administrative interfaces and databases further facilitates attacker operations and intelligence gathering. The broad deployment and accessibility of ARTEX instances amplify the risk of widespread exploitation across multiple industries.

Defensive guidance

The ARTEX platform itself is a tool used by attackers rather than a software vulnerability with a patch. Mitigation should focus on securing exposed ARTEX instances by restricting internet access to administrative interfaces, enforcing strong authentication, and monitoring for unauthorized ARTEX deployments. Organizations should also address the underlying web vulnerabilities exploited by ARTEX agents, such as RCE, command injection, IDOR, and SSTI, by applying security best practices and patches. Since ARTEX instances are often misconfigured and publicly accessible, immediate network-level access controls and vulnerability remediation are critical to reduce risk.

Summary

ARTEX is a Chinese AI-driven penetration testing platform that coordinates multiple AI agents using large language models to autonomously identify and exploit vulnerabilities. Check Point Research observed over 1,800 publicly exposed ARTEX instances, with 1,608 live and accessible during research. Operators set initial goals, after which AI agents autonomously conduct attacks, primarily financially motivated cybercrime on a broad scale. The agents exploit web vulnerabilities such as RCE, command injection, insecure direct object references, and privilege escalation to compromise targets. Notably, ARTEX has been used to steal iOS code-signing certificates from gray-market shops by exploiting vulnerabilities including hardcoded passwords, missing authentication, and server-side template injection. Despite the original project closure, forks and backups keep ARTEX available to threat actors. Other similar agentic hacking frameworks have also been observed. The exposed ARTEX panels provide insight into attacker models, prompts, and attack steps, revealing a high degree of automation and scale.

References

research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Nov 2026, 17:34 UTC

Technical details

References

Community reviews

Related threats