Check accounts after global AI-assisted hacking campaign targets multiple sectors

Zscaler ThreatLabz reported in October 2026 that a sophisticated hacking campaign combined the ARTEX penetration testing framework with artificial intelligence coding assistants and custom automation scripts. While initial reports focused on South Korean financial institutions, further investigation revealed the attacks were widespread, targeting organizations globally across various industry sectors. This research highlights how operators are leveraging AI to scale their intrusion activities.

Root cause

The campaign’s effectiveness stemmed from a customized deployment of ARTEX integrated with multiple AI models, including DeepSeek, GLM, and Grok, accessed through an OpenAI-compatible gateway. Operators used custom scripts to synchronize instructions and support handoffs between different AI sessions, ensuring continuity. This setup allowed the threat actors to divide investigation tasks and have one AI model review the findings of another, creating a self-correcting workflow that maintained context across accounts and servers.

Attack path

ThreatLabz analyzed saved project records and synchronization scripts that preserved investigation progress across the operator’s infrastructure. The environment included a work server storing project files and a jump server that served as the default route for connections to targets. Operators delegated research tasks to Grok on the jump server while instructing separate AI sessions to review those findings. This division of labor, overseen by the human operator, allowed for efficient processing of large volumes of data and targets.

Affected versions

The source material does not specify software versions or CVE identifiers associated with this campaign. Instead, the research focuses on the operational methodology and the configuration of AI workspaces rather than a specific software vulnerability. The attacks targeted organizations generally, with prompt histories revealing requests for data across multiple industries and geographic regions, indicating a broad scope rather than a version-specific exploit.

Mitigation

• Monitor network traffic for unusual connections to jump servers or unauthorized routing tools used in command-and-control communications.
• Review AI service configurations and access logs for signs of automated task delegation or unauthorized model interactions.
• Audit synchronization scripts and shared instruction files for anomalies that might indicate coordinated automation across accounts.
• Implement strict access controls for systems containing personal and transaction data to prevent bulk extraction by automated agents.

For customers and users

Organizations affected by this type of campaign should verify the integrity of their data repositories, particularly those holding personal and transaction records. Review access logs for automated activity patterns that do not match normal business operations. Be vigilant for follow-up scams, such as phishing emails claiming to offer data recovery or security fixes, which often follow such breaches. Ensure that AI tools and coding assistants are configured with strict permissions to prevent them from executing unauthorized network commands or accessing sensitive files without explicit human oversight.

Background: Threat actors

A threat actor is any individual or group that initiates a security incident. The term distinguishes the person or organization behind the attack from the technical method used. Analysts use this classification to predict future behavior and tailor defenses based on the actor’s goals rather than just their tools.

Read the full guide: Threat Actors Defined: Who They Are and How They Operate

What to do and how to stay safe: Zscaler

• Audit all AI coding assistants and automation tools in your environment to ensure they cannot access sensitive data or execute network commands without approval.
• Monitor logs for unusual synchronization activities or script executions that transfer files between accounts or servers, as this may indicate active intrusion.
• Verify the integrity of databases containing personal and transaction information, looking for signs of bulk data extraction or unauthorized queries.
• Educate staff to recognize and report phishing attempts that reference recent security incidents, as attackers often use such events to trick victims into revealing more credentials.

Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which organizations were targeted by this AI-assisted hacking campaign?

The campaign targeted organizations globally across multiple industry sectors, extending beyond the initial reports of South Korean financial institutions.

What tools did the threat actors use in this campaign?

Operators used the ARTEX penetration testing framework combined with AI coding assistants like Claude Code, Codex, and Grok, along with custom automation scripts.

What was the apparent motive behind these attacks?

Prompt histories revealed requests for bulk personal and transaction data, alongside questions about selling stolen data, suggesting a financially motivated objective.