ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates

Cybercriminals are now using ARTEX, an AI-powered penetration testing platform, to break into websites with almost no human input.

In the cases studied, the AI agents stole more than 190,000 gaming credentials and over 300 Apple code-signing certificates. Only three of those certificates still worked.

ARTEX was built as an open-source tool to help security teams test their own systems. Its developer made the project closed-source on October 8 after it appeared in a breach of South Korean banks, which we covered in a solo hacker AI case.

Forks and backups of the original code are still easy to find, so criminals keep using it. Researchers at Check Point noted the activity after finding 2,557 systems that host or once hosted ARTEX panels, and 1,608 of them were live and open to the internet.

Ten of those servers were set up wrongly and exposed their full databases. That gave Check Point a rare look at how operators prompted their agents and which AI models they picked.

ARTEX AI Agents Steal 190,000 Gaming Credentials

The Apple campaign targeted a gray market that sells .p12 signing certificates. These files let people sign and sideload iOS apps without the App Store.

One operator ran two ARTEX consoles from October 14 to October 29 and pointed them at 10 certificate signing shops. The agents used Deepseek v4.1 Flash and Kimi K3.1 Pro and processed about 36 billion tokens. Check Point estimates the cost at $700 to $1,500.

The agents got in through simple mistakes. They found hardcoded admin passwords in JavaScript files, web APIs with no login, weak admin passwords, and command injection flaws that allowed remote code execution.

They also used insecure direct object references and server-side template injection. In one case, the agent moved from a low-privilege user to root because of loose folder permissions.

After reaching each shop, the agents looked for the certificate library, a database of .p12 files and their plaintext passwords. They checked each key by decrypting it, matching the private key to the certificate, checking Apple’s revocation service, and checking the expiry date.

They also looked for a matching in-house provisioning profile. Of more than 300 certificates, three passed every check, so they could sign any iOS app.

The gaming campaign was simpler and larger. Chinese mobile gaming has a gray market for hacked “data accounts,” which buyers can use with only a QQ-Connect access token and a sideloaded login tool.

The operator aimed agents at 13 backend credential servers. Some of these servers kept a 21.5 MB plaintext credential file in the public web root. The agents recovered more than 190,000 credential sets for Honor of Kings alone.

Testing showed about 3.3 percent still worked, which Check Point puts at roughly 6,000 live accounts. The run lasted about five days on DeepSeek V4.1 Flash and cost an estimated $180 to $360. Operators barely touched the agents after setting the goal. Their messages were mostly short questions about progress.

What the ARTEX Campaigns Reveal About AI-Driven Cybercrime

Not every campaign worked. A third operator tried to drain cryptocurrency from 292 crypto payment domains. Across 230 findings and 400,791 agent messages, no money reached the attacker’s wallet.

Some agents claimed success based on API replies that only said “success,” which turned out to be false. Along the way, one agent found leaked AWS S3 credentials and gained write access to a bucket holding 714 enterprise-signed iOS app landing pages.

It could have swapped the app files for malicious ones. The bucket owners later restored the original manifest. The same pattern of cheap, fast, hands-off automation appeared in autonomous AI agents harvesting credentials in earlier reports.

Chinese models were the most common choice, with the Deepseek Flash family in the lead. Check Point saw guardrails trigger only with Anthropic’s Opus 5.5, and the operator then switched to a more permissive Chinese model.

Operators also used residential proxies to get around web firewalls and IP blocks. Of the live ARTEX servers, 882 (54 percent) sit in the US, 295 (18 percent) in Hong Kong, and 103 (6 percent) in China. Check Point also sees other frameworks, such as CyberStrike, Cairn and PentAGI, with similar abilities.

The risk comes from scale, not clever tricks. The agents tested every endpoint, script and site without stopping until they reached the goal. This matches the warnings in the CERT-In advisory on AI agents, which says exposed passwords and keys are the usual way in.

Companies should find and rotate exposed secrets, remove hardcoded credentials from front-end code, and require login on every API.

They should also test their internet-facing systems and watch for sudden bursts of requests. Readers who want more background can see how ARTEX automates Active Directory attacks.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates appeared first on Cyber Security News.