{"data":{"id":"fd210c82-b7e6-4532-b1a9-3ca0134d3a56","title":"Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents","summary":"Amazon Threat Intelligence reports that its MadPot decoy sensors, which imitated LLM inference APIs, captured requests from AI agents carrying operating memory from offensive campaigns run on ARTEX, an open-source agentic AI penetration testing framework, between Oct. 3 and Nov. 5, 2026. The most prominent campaign stole credentials for AI models and used stolen keys to pay for the inference driving further credential hunting, while another targeted cryptocurrency exchanges with real-time deepfake injection to bypass KYC verification. Amazon assesses with moderate confidence that ARTEX was used and that the groups are Chinese-nexus.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-observes-threat-actors-running-cybercrime-campaigns-with-artex-ai-agents/","publishedAt":"2026-11-13T20:26:42.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain","data_extraction"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["ARTEX","AWS","MadPot","LLM inference APIs"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-13T20:26:42.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}