Executive Summary
Zscaler ThreatLabz has identified a campaign, active since September 2026, where a suspected Chinese-speaking, financially motivated actor is using an open-source AI framework called ARTEX to target South Korean financial firms. The framework uses Large Language Models (LLMs) like DeepSeek and Grok to autonomously orchestrate complex attack chains, bypassing traditional manual penetration testing hurdles. The campaign successfully exfiltrated personally identifiable information (PII) for approximately 67,000 individuals.
The attack specifically targets peripheral, internet-facing assets such as inquiry portals and mobile backend APIs rather than core banking systems. By utilizing AI agents to perform high-speed reconnaissance and exploit vulnerabilities like SQL injection and authentication bypass, the actor significantly accelerated their intrusion timeline. This highlights a shift toward AI-automated exploitation where traditional scope controls and guardrails are intentionally bypassed or missing for commercial targets.
This activity poses a significant risk to the financial sector, particularly regarding data privacy and secondary fraud. Organizations should prioritize reducing their external attack surface and implementing rate-limiting or behavioral monitoring on all customer-facing endpoints to counter automated enumeration.