Hackers used artificial intelligence agents to breach at least nine South Korean financial institutions in October 2026. The attack compromised personal data from more than 25,000 banking customers.

Major domestic lenders bore the brunt of the intrusions. Shinhan Bank reported 25,000 compromised customer records, while KB Kookmin Bank confirmed 119 leaked customer profiles.

Running from late September to early October, the campaign relied on an open-source security tool named ARTEX paired with Anthropic’s Claude Code. A Chinese security researcher using the alias Autumn published ARTEX on GitHub earlier this year. The software functions as an automated penetration agent. It links directly into external large language models including ChatGPT, Claude and DeepSeek to run vulnerability tests across target servers.

The software repository explicitly restricts use to local testing and research. Even so, the attacker weaponised the framework against live online banking infrastructure. Cybersecurity firm CrowdStrike tracked the interactive sessions. The firm found that the operator fed target environments directly into AI coding interfaces to accelerate intrusion paths and system mapping.

During the operation, the operative inadvertently leaked personal information directly into model prompt logs. Session records show queries asking where threat actors sell compromised Korean databases and requesting specific Korean data-trading channels on Telegram. In a separate prompt, the attacker instructed Claude to compile a curriculum vitae. That document contained a personal Telegram handle, educational background, age and an address in Maoming, Guangdong province.

Digital infrastructure and Chinese-language prompts pointed investigators toward a 26-year-old individual operating out of southern China. “While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” CrowdStrike stated in its findings.

Source link