Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents

Summary

Amazon Threat Intelligence reports that its MadPot decoy sensors, which imitated LLM inference APIs, captured requests from AI agents carrying operating memory from offensive campaigns run on ARTEX, an open-source agentic AI penetration testing framework, between Oct. 3 and Nov. 5, 2026. The most prominent campaign stole credentials for AI models and used stolen keys to pay for the inference driving further credential hunting, while another targeted cryptocurrency exchanges with real-time deepfake injection to bypass KYC verification. Amazon assesses with moderate confidence that ARTEX was used and that the groups are Chinese-nexus.

Topics

• AI agents

Related items

• InfoAmazon has a plan to index the world’s online shopping dataSame vendor · The Verge (AI)
• InfoUnited Airlines blocks AI agents from booking flights, citing cybersecurity risksSame vendor · TechCrunch (Security)
• InfoStraiker EU & India Expansion | Regional AWS HostingSame vendor · Straiker Blog
• InfoJim Cramer: This is the bet you're making if you buy the Anthropic IPOSame vendor · CNBC Technology
• MediumAntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production SecretsSame vendor · The Hacker News