Microsoft says a financially motivated group it tracks as Storm-3358 began using the ARTEX agentic framework against financial-sector targets in October, while Check Point Research counted 1,608 live ARTEX operator panels and read the prompts that operators gave their agents.
The two vendors published within a day of each other and describe the same tool from opposite ends. Microsoft Threat Intelligence reports what ARTEX looks like from the victim side. Check Point Research reports what the operator side holds, after finding ten panels that exposed their full databases.
What Microsoft observed
In its 6 November post, Microsoft describes Storm-3358 as a Cambodia-based intrusion cluster that mainly targets financial organizations in Southeast Asia, plus a smaller number of large financial organizations worldwide. The group uses ARTEX alongside conventional automated tools to scan internet-facing systems, exploit flaws including anonymous file upload and server-side request forgery, and install open-source remote access trojans. Microsoft names three: WISP, vshell and AdaptixC2.
A second Microsoft post, published on 5 November, covers a different use of the same framework. Starting in August 2026, Microsoft saw an agentic framework send large volumes of queries to GitHub for exposed secrets, often including a target organization’s name plus keywords for cloud and AI services. From 28 October, Microsoft saw successful service principal sign-ins across dozens of applications in multiple tenants, including one case where a vendor-owned multitenant application credential opened access to downstream customers. In at least one case an agent went from scanning GitHub to taking data from Azure Key Vault in five minutes.
Microsoft says agentic tools like ARTEX can use compromised credentials and systems at machine speed to “move laterally, escalate privileges, and exfiltrate data.”
What Check Point found behind the panels
Check Point Research’s 5 November report describes ARTEX as a Chinese open-source penetration testing platform built for authorized testing. Its developer made the project closed-source on 8 October after it turned up in attacks on South Korean banks, but Check Point says maintained forks and backups keep it available. The firm found 2,557 systems hosting or having hosted ARTEX panels, 1,608 of them live and publicly reachable.
The ten exposed databases show which language models operators configured and how they prompted them. Chinese models dominated, with the DeepSeek Flash family the most common. Beyond the initial goal, Check Point says the operators barely interacted with their agents, mostly checking progress.
Check Point walks through three campaigns, all opportunistic and aimed at money:
- One operator ran two consoles from 14 to 29 October against ten grey-market iOS signing shops, using about 36 billion tokens at an estimated cost of $700 to $1,500. The agents recovered more than 300 code-signing certificates with passwords, and three passed the operator’s validation checks.
- A crypto-draining operation set agents on 292 payment infrastructure domains and logged 230 findings across 400,791 agent messages. Check Point reports the operator’s wallet held a $0 balance with no transactions, and that agents’ claims of successful cash-outs were hallucinations based on API responses reading “success”. One agent did write to a storage bucket that held iOS app landing pages, and the bucket owners later restored the original manifest file.
- A gaming-account campaign hit thirteen sites, and Check Point reports agents recovered more than 190,000 credential sets for one game, of which about 3.3% were still valid, roughly 6,000 accounts.
The vulnerabilities the agents used were ordinary ones: hardcoded administrator passwords in JavaScript bundles, missing authentication on web APIs, command injection, insecure direct object references and credentials left in a file in the web root. Check Point puts the lesson this way: “it is not necessarily the complexity of attacks, but the breadth and perseverance at which LLMs can audit a scope and test every endpoint, front end bundle and site, non-stop”.
Where the two accounts differ
Microsoft’s material is about intrusions that reached customer environments, including the identity layer. Check Point’s material is about operators, and in the crypto-draining campaign the agents’ access produced no money. Both agree on the shape of the activity: goals set by a person, then agents working through scanning, exploitation and follow-on steps with little further input. Microsoft stresses speed, with its five-minute example. Check Point stresses breadth and cost, with campaigns priced in the hundreds or low thousands of dollars.
What it means for the security leader
In our reading, the two reports move the planning question from whether attackers have agents to which of your exposed secrets and weak endpoints an agent finds first. The credentials Microsoft describes were valid ones taken from public repositories, which ties to earlier CyberTech reporting on attackers targeting stored credentials and on stolen keys turning into model usage within days. The UK NCSC has said UK infrastructure should brace for AI-powered ransomware by 2028, and these two vendor reports show an early, low-cost version already running.
The detection guidance is practical. Microsoft notes that agentic scanners send a wide variety of requests in a short time, retry variations of the same technique, and lean on existing tools such as Nmap, curl, wget, Python HTTP clients and headless Chromium. Default user agent strings can flag the activity, though Microsoft cautions that blocking them will not stop an agent that changes them. It also reports that decoys, tarpits and fake wins reduced attack traffic reaching real assets in its testing.
What defenders can do this week
- Search your own organization’s name and your cloud and AI service names across public GitHub, and enable public secret monitoring if your plan supports it.
- Rotate any secret found in a repository. Microsoft states that removing the original disclosure does not remediate the exposure.
- Move OAuth applications from client secrets to managed identities, as Microsoft recommends, and review which vendor-owned multitenant applications hold access to your tenants.
- Remove hardcoded administrator credentials from front-end bundles and confirm that every web API endpoint requires authentication.
- Alert on bursts of varied requests from a single source and on service principal sign-ins from addresses outside your normal range.
- Read the indicators in both vendors’ posts and check them against your logs.
Source: Microsoft Security Blog, ARTEX abuse expands as cybercriminals target financial sector
