ARTEX AI Hacking Tool: 1,608 Live Servers, Sub-$1,500 Raids

The ARTEX AI hacking tool is now running on more than a thousand public servers, and it is cheap to operate. Check Point found 1,608 live ARTEX panels, 54% of them in the US. One operator ran a two-week campaign against Apple code-signing shops on an estimated $700 to $1,500 of model tokens, mostly DeepSeek. Censys separately counted roughly 815 distinct deployments.

Key takeaways

• Check Point counted 1,608 live ARTEX servers; 882 of them sit in the US.
• A two-week certificate theft burned 36 billion tokens for an estimated $700 to $1,500.
• Agents pulled 190,000+ game credentials; only about 3.3% still worked.

What is the ARTEX AI hacking tool?

ARTEX is a Chinese open-source penetration-testing framework in which several AI agents plan an attack, run security tools and log what they find. It was built for authorized testing. Since its July release it has been tied to bank breaches in South Korea, the ConnectWise supply-chain compromise and a wave of cheap, mostly autonomous cybercrime.

According to Censys, ARTEX landed on GitHub on July 26, 2026, under the AGPL-3.0 license. It collected an estimated 1,500 to 2,000 stars in ten weeks.

The developer later took the project closed-source. That changed little. Forks, backups and rebrands such as ScopeWeaver still circulate, Censys and Check Point both report.

The design is simple to describe. A web dashboard tracks assets, progress and findings. Large language models drive the agents underneath. The operator sets a goal and mostly watches.

What did Check Point and Censys find?

Two research teams published on November 5, and TechCrunch brought the findings to a wide audience on November 6. Check Point mapped 2,557 systems that host or once hosted ARTEX panels and read the logs of three criminal campaigns. Censys counted exposed consoles and found them sitting next to classic attack tools.

Check Point: three campaigns, read from the attackers’ own logs

Check Point Research found 1,608 ARTEX servers live and reachable. Ten were misconfigured badly enough to expose their full databases. That leak let researchers read operator prompts, token counts and results.

Its verdict: “Most attacks were fully autonomous.” The actors were “opportunistic, financially motivated” and largely unsophisticated. Breadth and persistence, not clever exploits, did the damage.

Censys: hundreds of consoles open to anyone

Censys researcher Silas Cutler counted 1,465 hosts with an exposed ARTEX console as of November 4. About 650 sit in two blocks of identical hosting, which leaves roughly 815 distinct-looking deployments. TechCrunch reported more than 800 reachable without a password.

“Uniform configurations like these suggest a provisioning template rather than hundreds of individual operators,” Censys wrote. It also found 155 of those hosts, or 10.6%, running other threats such as Cobalt Strike, Vshell or Adaptix C2.

How much does an AI-run cyberattack cost?

Very little. Check Point estimated the token bills from the leaked logs. The largest campaign, two weeks against Apple code-signing shops, cost an estimated $700 to $1,500. A failed four-day crypto-draining run cost $145 to $300. A five-day raid on game-account servers cost $180 to $360.

Campaign	Duration	Tokens used	Est. cost	Result
Apple code-signing certificate theft	~2 weeks (Oct 14–29)	36 billion	$700–$1,500	300+ certificates and passwords; 3 passed validation
Crypto payment draining	4 days	167.5 million	$145–$300	292 domains probed, 230 findings, $0 stolen
Game account theft (Honor of Kings)	~5 days	~2.05 billion	$180–$360	190,000+ credential sets; ~3.3% (about 6,000) still valid

The economics come from caching. Of the 36 billion tokens in the certificate campaign, 33.79 billion were cache hits, according to Check Point. Agents re-read the same context over and over, and cached input is the cheapest thing a model provider sells.

That is why cheap Chinese models dominate the logs. Check Point names the DeepSeek Flash family as the most common engine, alongside Kimi K3.1 Pro. We covered why those models are so cheap in our pieces on DeepSeek V4.1 Flash 1017 and Kimi K3.1 Pro pricing.

Which AI models did the attackers use?

Mostly Chinese open or low-cost models. Check Point found DeepSeek V4.1 Flash and Kimi K3.1 Pro in the certificate campaign, DeepSeek V4 Pro in the crypto run and DeepSeek V4.1 Flash, through a third-party relay, in the gaming raid. A GLM model appears in one prompt. One US model refused.

Anthropic’s Opus 5.5 hit its guardrails on three ARTEX instances, Check Point reported. The operator simply switched to more permissive Chinese models. Refusals worked, and the attack carried on anyway.

Censys flagged the plumbing that makes the switch easy. It found 43 ARTEX hosts running LLM gateway or reseller software. “For defenders, unfamiliar LLM proxies and resellers in egress logs are worth investigating,” the firm wrote.

Who is affected?

So far the confirmed victims are gray-market businesses, South Korean financial firms and the customers of IT vendor ConnectWise. The bigger exposure is any company with a sloppy internet-facing perimeter: hardcoded passwords, unauthenticated APIs, credential files in web roots. Those are the flaws ARTEX agents actually exploited.

• ConnectWise customers. Microsoft says China-aligned Storm-0940 used ARTEX to try sign-ins at more than 2,250 tenants, reaching privileged access in under three hours in several cases.
• Korean finance. CrowdStrike tied a September wave of attacks on South Korean institutions to an ARTEX user. A later breach at Daishin Securities exposed data of 38,490 customers, TechCrunch reported; its root cause is still under investigation.
• Gray-market shops. Ten iOS signing shops and 13 game-account backends lost certificates and credentials in Check Point’s sample.
• US hosting providers. PEG Tech (AS54600) alone hosts 493 exposed ARTEX consoles, per Censys.

Microsoft summed up the problem plainly: “Agents are not constrained by factors affecting humans.” They do not sleep, and they try every door at once. At its peak the ConnectWise-linked spray hit 2,900 failed logins a minute.

Who wins and who loses?

Defenders who sell detection and exposure management win budget. Cheap Chinese model vendors face more pressure from US policymakers. Frontier labs with working guardrails get a marketing point but no real protection. Companies with weak perimeters lose the most, because attackers can now afford to scan everyone.

Winners

Security vendors gain a fresh, concrete threat to sell against. Check Point, CrowdStrike, Microsoft and Censys all published ARTEX research within a month. Expect “agentic attack” detection to show up in sales decks. CrowdStrike is already moving that way, as we noted in our piece on its AI kill switch.

Losers

DeepSeek and Moonshot now appear by name in a criminal playbook. That adds fuel to US scrutiny of Chinese model providers, a pressure already visible in the US AI distillation advisory that named six Chinese firms. Hosting providers with hundreds of exposed consoles also face abuse complaints.

The deeper loss is pricing power for attackers’ targets. When a campaign costs less than $1,500, the old math of “too small to bother with” disappears. We saw the same thing last month in the Cairn AI agent hack, where more than 100 firms were breached at about $50 each.

How scary is ARTEX, really?

Less than the server counts suggest, and more than the success rates suggest. Many exposed instances belong to legitimate testers, Censys stresses. The yields were poor. But cost per attempt is now so low that poor yields still pay, and the operators are learning.

Start with the numbers that do not line up. Check Point cites 1,608 live servers in one place and “more than 1,800” in its own key points. Censys counts 1,465 hosts but only about 815 distinct deployments. The researchers used different detection methods, so treat any single figure as a rough range.

Then look at results. Only 3 of the 300-plus stolen certificates passed validation. Only about 3.3% of 190,000 credentials still worked. The crypto run produced 400,791 agent messages and, in Check Point’s words, “not one cent moved to the attackers pockets.”

Even the agents oversold their work. In the crypto campaign, one cash-out was logged as a success from API responses while the wallet balance stayed at $0. AI attackers hallucinate wins, too.

The skeptical read cuts both ways, though. About 6,000 working game accounts for roughly $180 to $360 in tokens is a profitable trade for a criminal. Volume makes up for low hit rates.

What to watch next

No dated ARTEX milestones are public yet. The useful signals are new victim disclosures, changes in the exposed-server count, and how model providers and regulators respond. Watch these four.

1. ConnectWise restoration. Microsoft told customers to keep affected ConnectWise app connections disabled until the vendor issues formal restoration guidance. That notice will show how deep the cleanup goes.
2. Exposed-server counts. Censys saw 10 open directories close and 15 new ones appear between November 3 and 5. A falling count means operators are hiding; a rising one means adoption is spreading.
3. Model-provider response. Watch whether DeepSeek, Moonshot or the relays that resell their APIs add abuse controls after being named.
4. Korean regulator checks. Seoul plans security checks on dozens of private-sector IT systems, per TechCrunch. Findings could put more names on the victim list.

FAQ

Is ARTEX illegal?

No. ARTEX is a penetration-testing framework released as open source for authorized security testing. Using it against systems without permission is the crime, and that is what Check Point, CrowdStrike and Microsoft documented.

How many ARTEX servers are online?

Check Point found 1,608 live servers out of 2,557 that host or hosted ARTEX panels. Censys counted 1,465 exposed hosts, or about 815 distinct deployments. Not all of them are malicious.

How much did the ARTEX attacks cost to run?

Check Point estimated $700 to $1,500 for a two-week certificate theft, $145 to $300 for a four-day crypto run, and $180 to $360 for a five-day game-account raid, based on token use.

Which AI models power ARTEX attacks?

Mostly DeepSeek V4.1 Flash, DeepSeek V4 Pro and Kimi K3.1 Pro, per Check Point. Anthropic’s Opus 5.5 refused on three instances, and the operator switched to Chinese models.

Was ConnectWise hacked with ARTEX?

Microsoft attributes the ConnectWise supply-chain compromise to Storm-0940 and says the group used ARTEX to automate attacks, including sign-in attempts at more than 2,250 tenants.

How can companies defend against AI hacking tools?

Fix the basics ARTEX exploited: remove hardcoded secrets, require authentication on every API, keep credential files out of web roots, and watch egress logs for unfamiliar LLM proxies.

The bottom line

ARTEX is not a super-hacker. It is a cheap, tireless intern that tries every unlocked door and often reports wins that never happened. That is enough. When a two-week campaign costs less than a used laptop, every company with a weak perimeter becomes worth attacking. The winners are the firms that sell detection and the defenders who fix basic hygiene first. The losers are anyone still betting they are too small to notice.

Sources

• Check Point Research: Hacking on Autopilot, Inside ARTEX Cybercrime Campaigns (November 5, 2026)
• Censys: ARTEX, Agentic Asbestos (November 5, 2026)
• TechCrunch: Hundreds of Artex AI hacking tools found publicly exposed to the web (November 6, 2026)
• Microsoft Security: Storm-0940 uses ARTEX agentic AI in ConnectWise supply-chain compromise (October 21, 2026)
• TechCrunch: South Korea’s financial industry hit by fresh wave of cyberattacks (October 28, 2026)

Wealth Engine researches and drafts with AI tools and checks every figure against the sources above. How we report.