AI agents stole 190k gaming credentials for under $400 in model costs

Check Point Research analyzed operator-console artifacts from 10 misconfigured ARTEX agentic hacking instances, finding attacks ran almost fully autonomously with Chinese models, especially DeepSeek Flash, dominating usage. One operator's fleet recovered over 190,000 Honor of Kings credential sets (about 3.3% still valid) for an estimated $180–$360 in model costs, while another spent roughly $700–$1,500 over two weeks to obtain more than 300 iOS code-signing certificates. Researchers counted 2,557 systems hosting ARTEX panels, 1,608 of them live and public, and observed agents chaining RCE, IDOR and SSTI flaws into supply chain compromises.