As cited
Copy frozen at (site build).
threat intel
Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
Zscaler ThreatLabz identified a financially motivated threat actor using ARTEX, an open source agentic artificial intelligence (AI) penetration testing framework, to target South Korean financial institutions starting in late September 2026. The actor exploited peripheral web applications through AI-driven reconnaissance and exploitation of vulnerabilities including SQL injection and authentication bypass, exfiltrating personally identifiable information (PII) belonging to approximately 67,000 individuals. The threat actor then used AI to plan monetization of the stolen data through Korean-language Telegram channels.
Why it matters: South Korean financial institutions and any organization using open source AI pentesting frameworks face active exploitation; practitioners should immediately isolate such frameworks from production environments, restrict credentials, and deploy detection controls for AI-generated reconnaissance patterns and data exfiltration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
Zscaler ThreatLabz identified a financially motivated threat actor using ARTEX, an open source agentic artificial intelligence (AI) penetration testing framework, to target South Korean financial institutions starting in late September 2026. The actor exploited peripheral web applications through AI-driven reconnaissance and exploitation of vulnerabilities including SQL injection and authentication bypass, exfiltrating personally identifiable information (PII) belonging to approximately 67,000 individuals. The threat actor then used AI to plan monetization of the stolen data through Korean-language Telegram channels.
Why it matters: South Korean financial institutions and any organization using open source AI pentesting frameworks face active exploitation; practitioners should immediately isolate such frameworks from production environments, restrict credentials, and deploy detection controls for AI-generated reconnaissance patterns and data exfiltration.
- Source published
- First seen by Cybersecurity Tracker