High · 1 source · latest 1h

ARTEX AI pentest tool abused to steal gaming logins and Apple signing certificates

AI SECURITYCheck Pointredteam/daily · 1 source

Severity: High
Sources: 1

What happened

ARTEX, an open-source AI-driven penetration testing platform, is being run by criminals against websites with minimal operator input. Check Point found 1,608 live ARTEX panels exposed to the internet and observed campaigns that harvested over 190,000 Honor of Kings credential sets and more than 300 .p12 Apple signing certificates, of which three passed all checks. Entry came through hardcoded passwords in JavaScript, unauthenticated APIs, weak admin passwords, command injection, IDOR, SSTI and loose folder permissions.

For IT people · Written by AI from 1 source · Wrong?

What to do

Find and rotate any exposed secrets, including passwords, keys and certificates.
Remove hardcoded credentials from front-end and JavaScript code.
Require authentication on every API endpoint.
Test internet-facing systems and watch for sudden bursts of requests.

Written by AI from the sources, checked against them

Read the full story at the source