InfoSecBulletin Cybersecurity for mankind
Hackers used ARTEX, a free tool for testing security with AI, to attack over 200 organizations in 14 countries. The operation started on October 17 and focused on government offices, phone companies, and groups in the medicine, tech, defense, nuclear, and finance fields.
The attacker got into at least nine organizations and did password spraying attacks and checked passwords for at least 12 other important targets. According to researchers at CrowdStrike, the “campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator.”
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
Confirmed victims include phone companies in the United States and Belgium, government groups in Greece, the Middle East, and Latin America, and drug companies in the U.S.
The researchers identify the threat actor as Vapor Panda. They say that in the attack on the Greek government, the AI agents created a fake admin token and accessed inboxes using authentication keys from a 2022 mail-server directory export.
ARTEX AI is a tool for testing security. It was made by Chinese developers and first released as open-source. Later, the creators changed it to a paid product after it was used in actual attacks, like one against banks in South Korea.
In its latest hacking operation, Vapor Panda used DeepSeek and another unknown language model to plan and manage agents during several attacks at the same time. CrowdStrike says the attackers issued instructions in Chinese and intervened at critical points where decisions needed to be made.
The AI agents gathered information, took advantage of weak spots, installed web shells, got login info, and looked for other ways to attack when necessary. The operators told the agents to avoid Windows machines that had Falcon, CrowdStrike’s security solution, and to concentrate on unprotected computers.
In one event, the AI agents used over 1.4 billion input tokens, the researchers think.
CrowdStrike also found that the bad actor used BLOODALCHEMY, a backdoor that has been active since 2023, against government agencies in Latin America and the Middle East.
More ARTEX AI cases emerge
The Dutch Institute for Vulnerability Disclosure (DIVD) gave more information about the cyberattack it had in September 2026, which it blamed on an AI agent.
According to its latest update, the tool used in the attack on its network was ARTEX AI, which acted autonomously. DIVD said in a LinkedIn post that the attack went from entry to full control in 12 minutes, using a Zammad zero-day and a second zero-day for gaining local privileges.
The agent did many tasks at the same time. This included checking a hacked email, looking at the internal network, taking login tokens, and trying to reset passwords.
DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack, describing the activity as “super loud and messy.”
Related News:
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
