Microsoft says the ARTEX agent framework is spreading to new attackers

Microsoft’s threat intelligence team published two reports in as many days on attackers using ARTEX, the open-source agentic penetration-testing framework already tied to bank breaches in South Korea, a China-aligned supply-chain attack and a China-nexus campaign against more than 200 organisations.

The first, dated 5 November, said agents using ARTEX had been searching GitHub for exposed secrets since August 2026, using target organisation names and keywords for cloud services and AI providers. From 28 October, Microsoft observed successful service-principal sign-ins using stolen credentials, across dozens of applications in multiple tenants. In one case an agent went from GitHub search to Key Vault data exfiltration “in five minutes”, and when requests failed it changed HTTP methods or API versions until they succeeded. Microsoft did not attribute the campaign to a named group, and advised treating any publicly exposed credential as compromised.

The second, on 6 November, linked a financially motivated, Cambodia-based cluster it tracks as Storm-3358 to ARTEX use against financial organisations, mainly in Southeast Asia, from October. Microsoft said the group exploited anonymous file-upload and server-side request forgery flaws and installed open-source remote-access tools. It also cautioned that blocking network traffic with these characteristics “will not stop an attack by an AI agent”, because agents can change their traffic patterns quickly.

Other publications the same week widened the picture. Censys researcher Silas Cutler counted 1,465 hosts running an exposed ARTEX console on 3 and 4 November. About 650 sat in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments, and Censys said the true total was probably higher. It found 32 open directories holding implants and post-exploitation tools, and 155 hosts that also ran other known attack tooling. And India’s national CERT issued advisory CIAD-2026-0058 on 4 November about an actor it called Crafty Falcon, using ARTEX, CyberStrikeAI and Cairn against non-bank lenders, fintechs and crypto exchanges. Infosecurity Magazine reported that CERT-In named no state sponsor, though earlier malicious use of these tools had mostly been linked to China-based actors.

Taken together, the reports describe one open-source tool in use by an espionage group, a criminal cluster and a further unattributed actor. The Censys figure counts exposed consoles of any kind and is not an estimate of malicious use.