Amazon discloses ARTEX AI agent attack campaign
Understand this story
The Amazon threat intelligence team stated that its honeypot network MadPot captured requests sent by AI agents between October 3 and November 5, 2026, and these requests contained run records left by a threat actor running an attack campaign on the open-source agent penetration testing framework ARTEX. According to Amazon, this means a threat group used ARTEX's AI agents to carry out cyberattacks, and traces of the related activity entered its decoy sensors along with the agent requests. ARTEX itself is an open-source penetration testing framework, and this time it was used for attack purposes.
AI overview based on source reports · Updated 2 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIFeaturedAmazon Threat Intelligence observes threat actor campaigns with ARTEX AI agents
Amazon Threat Intelligence reports that between Oct. 3 and Nov. 5, 2026, its MadPot decoy sensors captured requests from ARTEX agentic AI penetration-testing agents that carried their own campaign records, including a large-scale AI credential theft operation in which stolen keys paid for the LLM inference used to hunt more keys, and a campaign against two cryptocurrency exchanges using real-time deepfake injection to bypass KYC checks. Amazon assesses with moderate confidence that ARTEX was used and that the activity comes from disparate Chinese-nexus threat groups, based on simplified Chinese prompts, China time-zone configurations, targeting and tooling. The post shares IOCs and argues that while the techniques were not new, agents change attacker speed and persistence, making basic hygiene such as removing default credentials and exposed secrets the most effective defense.
Activity for this story
Not enough continuous observations to show a trend yet.