An attacker’s own operational security failure has handed researchers an unusually detailed look inside a real-world AI-assisted hacking campaign — including which AI models, scripts and proxy services were used to breach South Korean financial institutions.

Between late September and early October 2026, seven South Korean financial firms had data stolen through internet-facing systems, exposing names, employment details, income data and loan information belonging to roughly 66,000 to 67,000 individuals and around 2,200 companies. CrowdStrike first linked the intrusions to ARTEX, an open-source, China-developed AI penetration testing framework, and assessed with moderate confidence that a single financially motivated, Chinese-speaking operator working alone — rather than an established hacking group — was behind the activity. The ARTEX GitHub repository and its associated Docker image were pulled down on October 11, though copies continue to circulate.

A Careless Server Exposes the Playbook

Public reporting from CrowdStrike and Genians had already identified one key piece of infrastructure, a server at a specific IP address along with a reseller domain used to route AI model traffic. But researchers at Hunt.io, pivoting off that known server, discovered a second, far more revealing exposure: an open directory on a Hong Kong-based jump server holding a much larger set of the operator’s working files.

That server contained a state file showing the attacker had launched Claude Code — Anthropic’s coding assistant — 510 times since early August 2026. Crucially, those sessions weren’t actually talking to Anthropic’s own infrastructure. A tool called Claude Code Router, paired with custom Python helper scripts, quietly redirected every request through the reseller domain to DeepSeek instead — a pattern Hunt.io notes resembles other cases where Claude Code has been paired with an unauthorized backend model. One of the helper scripts even contained a comment, written in Chinese, describing the redirection in the operator’s own words. Additional files revealed a Zhipu AI key for accessing GLM models and a tunnel configuration named for Grok, lining up with CrowdStrike’s earlier assessment that the operator cycled through DeepSeek, GLM and Grok during the campaign.

Nineteen “Skills” and a Peek at the Target List

Among the most revealing finds was a set of nineteen custom AI agent “skills” — reusable instruction sets — that had collectively been invoked 147 times. They covered reconnaissance, code review, web application testing, firewall bypass checks, Android application analysis and even remote control of cloud-hosted virtual phones. One skill specifically targeted payment logic, and researchers found three test accounts nearby tied to a cash-in deposit service, suggesting the operator was hunting for insecure direct object reference flaws — a common and serious bug class that lets an attacker view or modify another user’s data simply by altering an identifier in a request.

A credentials file, bluntly named “.secrets,” carried its own Chinese-language warning describing itself as the operator’s “sole source of credentials” and cautioning against ever pasting passwords directly into an AI session — ironic operational security advice coming from someone who left the file sitting in a publicly accessible directory. That same login was reused across several scripts to maintain a persistent reverse SSH tunnel and to copy the AI agent’s memory files back to the jump host.

A Framework With a Much Wider Footprint

Hunt.io’s investigation didn’t stop at the bank-related material. The exposed infrastructure also included a proxy service offering dozens of rotating exit IP addresses, a staged exploitation setup for remote code execution via JNDI and LDAP, cryptocurrency exchange scripts, Linux privilege escalation tools, and both iOS and Android tooling — though the researchers are careful to note the link between these additional tools and the specific bank breaches remains unconfirmed.

Using certificate fingerprints, malware tags and distinctive console page titles, Hunt.io identified well over a thousand ARTEX-related indicators spanning roughly 30 countries, led by the United States, China and Hong Kong — evidence that the framework’s use extends considerably beyond this single incident. Separately, South Korean police have since arrested a suspect in a related case also involving ARTEX, though investigators caution that shared tooling alone doesn’t confirm the same individual was responsible for both.

For defenders, the case underscores a now-familiar lesson with an AI twist: lock down administrative interfaces behind a VPN or allowlist, rotate any credentials that may have touched exposed infrastructure, and start treating unusual traffic to AI model gateways and reseller APIs as a monitoring priority alongside more traditional command-and-control indicators.