---
title: "[AUTO] ARTEX Attacker Exposed by Leftover Session Logs"
pubDatetime: 2026-10-09T07:04:00.000Z
description: "A threat actor using AI tools to breach Korean banks was identified through exposed Claude Code sessions and configuration files."
tags: [ai-security, incident-response, vulnerability, 2026, 2026-q4, 2026-10, AUTO]
---
A threat actor breached South Korean banks including Shinhan and KB Kookmin using [ARTEX, an open-source AI pentesting tool,](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) alongside DeepSeek, GLM, and Grok to compromise loan inquiry services and employee mobile work platforms. CrowdStrike found the attacker used Claude for reconnaissance, asking where Korean data is sold. What exposed them wasn't tool sophistication; it was opsec failure.

The attacker left public directories with Claude Code sessions, ARTEX configs, memory files, and personal information identifying them as a 26-year-old from Guangdong. CrowdStrike traced approximately 68,000 records through these artifacts.

Chaining multiple tools creates multiple layers of logs and config. Securing all simultaneously is harder than securing one. This attacker optimized for each tool's capability without accounting for aggregated risk of traces across platforms.

This isn't a failure of ARTEX or Claude. It's a failure of discipline integrating tools into an attack.

---

*Sources: [Unknown Threat Actor Uses ARTEX to Target South Korean Finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)*

*Coverage: [ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html)  •  [CrowdStrike finds possible bank hacker's CV among exposed AI logs](https://www.theregister.com/cyber-crime/2026/10/08/crowdstrike-finds-possible-bank-hackers-cv-among-exposed-ai-logs/5301908)*

*Related on this blog: [[AUTO] AI agents executed ransomware in hours](/posts/auto-ai-ransomware-hours)  •  [[AUTO] An AI Agent Exploited Snowflake's Shell Injection Flaw](/posts/auto-snowflake-red-agent)  •  [[AUTO] A loud autonomous AI agent breached DIVD](/posts/auto-divd-ai-agent-breach)*