Executive Summary
In October 2026, Zscaler ThreatLabz identified a global hacking campaign utilizing the ARTEX penetration testing framework enhanced by multiple AI models, including DeepSeek, GLM, and Grok. The campaign, likely operated by a Chinese-speaking actor, features a sophisticated architecture where AI agents are assigned specialized roles—such as reconnaissance, code review, and peer-reviewing findings—to maintain persistent context across sessions.
The attack chain involves a localized ARTEX deployment on a work server, which communicates through a dedicated jump server to mask the primary infrastructure. The actor used custom synchronization scripts and AI hooks to automate task handoffs and maintain a project-wide 'memory' of targets. This automation allowed the adversary to scale operations across dozens of countries and diverse sectors, including finance, cryptocurrency, and retail.
The primary objective appears to be financial gain through the collection of structured PII and mobile phone numbers for potential sale on underground markets. The actor explicitly instructed AI models to prioritize database dumps with phone fields and cautioned against direct financial transfers that might trigger security alerts, indicating a calculated, long-term approach to monetization.