South Korean Banks Were Hacked Using Chinese AI Agent, Researchers Say

An AI pen testing tool was used to exfiltrate data from South Korean financial firms, showing AI's growing use in sophisticated cybercrime.

Researchers from CrowdStrike have identified a cyberattack campaign targeting South Korean financial firms between late September and early October 2026. The attackers utilized ARTEX, an open-source, AI-powered penetration testing tool developed in China, alongside large language models (LLMs). Evidence of the campaign was found in exposed Claude Code session histories and ARTEX configuration files hosted on a Hong Kong-based IP address. The campaign is suspected to be driven by financial motives and operated by a Chinese-speaking entity, though it has not been linked to any known threat groups. The ARTEX tool leveraged LLMs including DeepSeek v4.1-flash, Z.ai's GLM-5.3, and SpaceXAI's Grok 4.6, with DeepSeek likely accessed via the LLM API reseller 'xcai.pro.' During the campaign, the threat actor also used Claude to inquire about methods for selling stolen Korean data. In response to the misuse, the developer of ARTEX, Autumn-27, has taken the tool closed source, stating it was originally intended for security research and authorized testing.

The incident highlights a significant escalation in the use of agentic AI for offensive cyber operations. By employing tools like ARTEX, which leverage LLMs for autonomous penetration testing, threat actors can automate complex attack chains, increasing their efficiency and potential for data theft. This development signifies a shift towards more sophisticated, AI-driven attacks that can potentially bypass traditional security measures, posing a greater challenge for financial institutions and cybersecurity defenders alike.

The dual trend of sophisticated AI tools being developed and subsequently misused underscores the rapidly evolving threat landscape. The developer's decision to make ARTEX closed-source indicates the immediate impact of such abuses, but the underlying technology and methodologies will likely be replicated or adapted by other actors. Organizations must therefore anticipate and prepare for increasingly intelligent and autonomous cyber threats that require proactive, AI-informed defense strategies.