# Chinese AI models drive autonomous cybercrime campaigns as agentic hacking tools spread > Over 1,600 publicly exposed ARTEX AI hacking tool instances are running autonomous cyberattacks, with campaigns costing as little as $145. Operators recovered over 300 Apple code-signing certificates and 190,000 game credentials while targeting crypto, sideloading, and gaming infrastructure. - Type: AI news - Page: https://completeaitraining.com/news/chinese-ai-models-drive-autonomous-cybercrime-campaigns-as/ - Published: 2026-11-08 - Updated: 2026-11-07 - Author: Jeroen Erne - Jobs: Healthcare, Insurance, IT and development, Legal, Operations - Reading time: 2 min More than 1,600 publicly exposed instances of the AI hacking tool ARTEX are currently online, according to new research from Check Point Research. The analysis, which includes rare access to 10 misconfigured operator consoles, shows that cybercriminals are using these agentic platforms to run fully autonomous attacks targeting cryptocurrency, code-signing certificates, and gaming accounts at a cost of just a few hundred dollars per campaign. #### How autonomous agents operate with minimal human input ARTEX is an open-source penetration testing platform that uses large language models to coordinate AI agents capable of finding and exploiting vulnerabilities. After the tool was used in attacks against South Korean banks, its developer made the project closed-source on October 8. Multiple maintained forks now keep the tool publicly available to threat actors. Check Point Research obtained artifacts from 10 misconfigured ARTEX databases, revealing exactly how operators prompted their agents and which models they used. The data shows that once an initial goal is set, the systems run with almost no human interaction. Most operator messages simply asked for progress updates. "Which one is closest to the goal?" and "What's the current progress?" appear repeatedly across the logs, with operators rarely issuing tactical commands. Chinese models dominated the configured LLMs, with the Deepseek Flash family being the most prevalent. When operators tried Anthropic's Opus 5.5, they hit guardrails and subsequently switched to more permissive Chinese models. The DeepSeek API costs for observed campaigns ranged from roughly $145 to $1,500, depending on scope and model choice. #### Three campaigns show the breadth of autonomous attacks One operator tasked agents with stealing Apple .p12 code-signing certificates from gray-market signing shops. These certificates enable sideloading iOS apps outside the official App Store. Over two weeks, agents targeted 10 different shops using vulnerabilities including hardcoded administrator passwords in JavaScript bundles, command injection, and Server Side Template Injection. The fleet recovered more than 300 certificates, with three passing full validation. A second campaign aimed at draining cryptocurrency from payment infrastructure. Agents scanned 292 crypto payment domains and were instructed to "plant a backdoor-locate the site's deposit/withdrawal receiving address configuration and change it to the receiving address." While agents identified multiple vulnerabilities, including a supply chain attack vector through exposed AWS S3 credentials, the operator's wallet showed a balance of zero across the entire operation. The third campaign targeted gray-market credential shops for Chinese mobile games. Agents reverse-engineered APKs and discovered that some platforms stored credentials in unprotected static files on their web servers. The fleet recovered more than 190,000 sets of credentials for Honor of Kings alone, with roughly 3.3% still valid-translating to approximately 6,000 compromised accounts. #### Infrastructure spans continents The geographic distribution of live ARTEX servers shows the largest concentration in the United States (882 instances, 54%), followed by Hong Kong (295, 18%) and China (103, 6%). The number of newly created servers spiked in mid-October, coinciding with public reporting about the project. Analysis of version tags revealed three distinct clusters likely managed by the same operators, with one cluster controlling 255 hosts through PEG TECH INC in the United States. Many operators configured their agents to use residential proxies to bypass WAF restrictions and obscure traffic. One operator even created a dedicated skill for proxy usage, according to the exposed console data. #### Why this matters for IT and security professionals Agentic hacking tools lower the barrier to sophisticated attacks. Operators with minimal technical knowledge can deploy fleets that work non-stop to audit every endpoint, front-end bundle, and API on a target. The breadth of vulnerability types exploited-from hardcoded credentials to RCE and supply chain injection-means perimeter systems need testing against a wider attack surface than manual assessments typically cover. Professionals responsible for securing web applications and APIs should expect higher volumes of automated reconnaissance and exploitation attempts, particularly against publicly exposed administrative interfaces and authentication endpoints. --- This is the Markdown form of https://completeaitraining.com/news/chinese-ai-models-drive-autonomous-cybercrime-campaigns-as/. The whole site is mapped at https://completeaitraining.com/llms.txt.