AI Pentesting Tool ARTEX Used in South Korean Financial Data Theft

Cybersecurity researchers revealed a campaign targeting South Korean financial firms, using the AI-powered pentesting tool ARTEX. Active from late September to early October 2026, the attacks resulted in data exfiltration. The tool, developed by Autumn-27, leveraged large language models (LLMs) and was linked to a Hong Kong-based IP address. Evidence suggests a Chinese-speaking operator motivated by financial gain, although no specific threat group has been identified. The misuse of ARTEX prompted its developers to switch it to closed source, emphasizing its original intent for authorized security testing.