Hundreds of copies of Chinese-made ARTEX hacking tools leaked online for anyone to use in further attacks
Likely not all instances are malicious, but at least a tenth were used alongside other known hacking tools.
Over 1,400 instances of ARTEX hacking tools, a Chinese-made offensive security software, have been exposed online, according to researchers. These instances, often misconfigured, include malware, exploits, credentials, and internal infrastructure. According to Censys, they identified 1,465 hosts running exposed ARTEX consoles, with 155 (about 10%) also using other cyberattack tools like Cobalt Strike and Vshell.
Some public directories on ARTEX hosts exposed exploit binaries, post-exploitation tools, and sensitive files. ARTEX, originally an AI-enhanced reconnaissance tool, has been hijacked for malicious use. It was developed by Autumn-27, who later distanced themselves from illicit use after its release in July 2026. Despite the repository being taken down, copies and rebrands continue to circulate online.
Threat actors have used ARTEX in attacks, including compromising South Korean financial institutions. They have been seen pairing ARTEX with other tools like CyberStrikeAI, PentAGI, and RedAmon. Some installations have exposed operators' home directories and sensitive files. Not all exposed instances are malicious; about 650 belong to identical hosting infrastructure, leaving around 815 unique installations.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
