AI pentesting tool ARTEX surfaced in South Korean finance breaches
An unknown threat actor used the open-source agentic pentesting tool ARTEX alongside large language models in a campaign that exfiltrated data from South Korean financial organizations, showing how AI tooling is entering real intrusion workflows. CrowdStrike found exposed server directories containing Claude Code sessions, ARTEX configuration files, and memory files, which revealed Chinese-language prompts for conducting penetration tests. The campaign ran from late September to early October 2026 and used a two-server setup, according to the analysis.