A suspected China-based attacker allegedly used artificial intelligence tools to target South Korean financial institutions, according to a new report from cybersecurity firm CrowdStrike. The campaign, which ran from late September to early October 2026, highlights growing concerns about the misuse of AI in cybercrime.
CrowdStrike said the unidentified individual used ARTEX, an open-source AI-powered penetration-testing tool developed in China, alongside large language models and coding tools, including Anthropic’s Claude Code. The company’s investigators examined exposed AI session histories, configuration files and digital infrastructure linked to the attacks.
The investigation suggested that the attacker may be a 26-year-old based in Guangdong province, China. However, CrowdStrike said the activity has not been attributed to a named threat actor, and the personal details uncovered could not be definitively linked to the individual responsible.
The attacks reportedly affected multiple South Korean financial organisations. Shinhan Bank said information belonging to around 25,000 customers had been compromised, while KB Kookmin Bank reported a leak involving 119 customers, according to published reports.
Investigators also found prompts asking about online marketplaces and Telegram groups used to sell stolen South Korean data. These findings contributed to CrowdStrike’s assessment that the suspected attacker was likely financially motivated.
ARTEX is designed to automate penetration testing by connecting with external AI models. Its developers describe it as a tool for learning, code research and authorised security testing, warning against unauthorised real-world use.
The incident demonstrates how AI agents may help individual attackers operate at greater speed and scale. However, the full extent of the breaches, the attacker’s identity and the amount of data stolen remain unconfirmed.

AdvertisementThe Puranic