ARTEX attacks can give cloud access in less than a day

Unit 42, a research team for computer safety, tells that attackers use ARTEX in attacks on companies in many countries. ARTEX is a free AI tool for safety tests. The team found 609 hosts on the internet that operate it in October 2026. The attacks hit retail and consulting firms, and cloud systems in other sectors.

How it works

ARTEX is open-source, that is, its code is open to all. Many AI agents work together. They read the replies, change the method when a step does not work and continue. The attackers start at public password reset pages and open APIs. They then use the credentials they find to get access to the cloud.

The numbers

Unit 42 counted 609 hosts that operate ARTEX and 1,323 hosts that operate CyberStrikeAI. This tool is almost the same type. 21 hosts operate the two at the same time. The team looked at 14 tools in all. It gave no count of companies with damage.

What is not known

One sign can come from a person who tests one step at a time. In one attack, the attacker used a browser for the most sensitive steps, and a person can help. The author closed the code to stop misuse, but Unit 42 tells that new tools follow it.

Insight: Closing the code did not stop the tool

The author of ARTEX closed the code in October to stop misuse, but Google tells that its more than 12,000 copies are in use with new names. The tool is out and cannot be removed, and the control that is left is the company that it attacks. Monitor the new tools.