[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN9N-zwJO98ob_6IJWFkm-b8jfYRjisvIL6bjxW_rM5s":3},{"article":4,"iocs":53,"watch_terms":56,"solutions":57,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1a1f53e0-f1aa-464d-b011-235e2dd2f247","ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates","artex-ai-agents-steal-190-000-gaming-credentials-and-hundreds-of-apple-code-sign-379a9d","Cybercriminals are now using ARTEX, an AI-powered penetration testing platform, to break into websites with almost no human input. In the cases studied, the AI agents stole more than 190,000 gaming credentials and over 300 Apple code-signing certificates. Only three of those certificates still worked. ARTEX was built as an open-source tool to help security […] The post ARTEX AI Agents Steal 190,000 Gaming Credentials and Hundreds of Apple Code-Signing Certificates appeared first on Cyber Security News.","Cybercriminals are leveraging ARTEX, an AI-powered penetration testing platform, for automated attacks. In recent campaigns, ARTEX agents successfully stole over 190,000 gaming credentials and more than 300 Apple code-signing certificates, with a small percentage of these credentials remaining active. The platform exploits common web vulnerabilities like hardcoded passwords and insecure APIs, demonstrating a shift towards low-human-input cybercrime.","AI platform ARTEX used by cybercriminals to steal 190,000 gaming credentials and 300 Apple code-signing certificates.","https:\u002F\u002Fcybersecuritynews.com\u002Fartex-ai-agents\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FARTEX-AI-Agents-Steal-190000-Gaming-Credentials-and-Hundreds-of-Apple-Code-Signing-Certificates.webp","2026-11-06T13:49:57+00:00","2026-11-06T14:00:30.943883+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"AI","technology",{"name":24,"type":19},"Honor of Kings",{"name":26,"type":27},"Apple","vendor",{"name":29,"type":27},"Check Point","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54],{"type":50,"value":18,"context":55},"AI-powered penetration testing platform used for malicious activities",[26,29,18],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":89,"name":90,"problem":91,"products":92},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[147,152],{"slug":148,"name":26,"logo_path":149,"roles":150},"apple","\u002Fvendor-logos\u002Fapple.png",[151],"affected",{"slug":153,"name":29,"logo_path":154,"roles":155},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"ai-powered-artex-platform-automates-mass-credential-and-certificate-theft","AI-Powered ARTEX Platform Automates Mass Credential and Certificate Theft","The ARTEX platform demonstrates how AI is lowering the barrier for cybercriminals by automating exploitation of well-known, preventable vulnerabilities such as hardcoded passwords and insecure APIs. The theft of 190,000 gaming credentials and over 300 Apple code-signing certificates shows that organizations are still failing to remediate basic security misconfigurations at scale. Code-signing certificates are particularly dangerous in adversary hands, as they can be used to sign malicious software with trusted identities, amplifying downstream supply chain risk. This incident matters because AI-driven automation means attackers can now enumerate and exploit these weaknesses across thousands of targets in the time it previously took to compromise one.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","GDPR Article 32","CIS Control 17: Incident Response Management",{"GDPR Article 32":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"CIS Control 17: Incident Response Management":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"The theft of 190,000 credentials constitutes a large-scale personal data breach; Article 32 requires organizations to implement appropriate technical measures—including secure credential storage and API security—to prevent exactly this type of unauthorized access.","SI-2 mandates timely identification and correction of system flaws; enforcing this would have closed the insecure API and hardcoded credential weaknesses that ARTEX agents leveraged for mass credential harvesting.","With active credentials still valid post-breach and code-signing certificates compromised, a mature incident response plan is critical to rapidly contain, revoke, and communicate the scope of the damage to affected users and downstream systems.","The insecure APIs exploited by ARTEX align with OWASP's category of misconfigured or weakly implemented components, reinforcing the need for secure API design and regular review of exposed interfaces.","ARTEX specifically exploits common, unpatched vulnerabilities like insecure APIs; a continuous vulnerability management program would identify and remediate these weaknesses before automated attackers can weaponize them.","This control requires organizations to systematically identify and address technical vulnerabilities, directly targeting the hardcoded passwords and insecure API configurations that ARTEX exploited in this campaign.","Hardcoded passwords represent a fundamental failure of identity management; this framework function requires proper credential governance that would prevent static, exploitable secrets from persisting in production systems."]