ARTEX AI Hacking Tool Breaches Shinhan Bank, Stealing 25,000 Records: South Korea Investigates

AI-Powered Tool ARTEX Linked to South Korean Bank Breaches

A suspected Chinese-speaking attacker used ARTEX, an open-source AI hacking tool, to breach multiple South Korean financial institutions between late September and early October 2026, stealing over 25,000 records from Shinhan Bank. South Korea's financial regulator held an emergency meeting, and President Lee Jae Myung called for a thorough investigation into the incident.

The ARTEX Tool and Its Capabilities

ARTEX, a Chinese open-source tool, was initially posted on GitHub in July 2026. It is designed to use artificial intelligence language models for automated penetration testing. The tool reportedly operated on widely available models, including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, demonstrating how accessible AI models can be repurposed for malicious activities.

The use of such an AI tool highlights a growing concern within cybersecurity: the ability of a single individual to execute large-scale breaches rapidly. CrowdStrike has noted that AI tools are increasingly enabling individual actors to conduct massive data thefts in short timeframes, a trend exemplified by the ARTEX incidents.

Shinhan Bank Data Breach Details

The breach at Shinhan Bank led to the compromise of more than 25,000 customer records. The stolen data included sensitive information such as names, contact details, income figures, and credit limits. The extent of the data stolen from other financial institutions remains under investigation.

Attacker's Modus Operandi and Investigation

Evidence found in the attacker's open directories, specifically Claude Code session logs, indicated searches for Telegram groups. These searches suggest an intent to sell the stolen data on illicit markets. The discovery of these logs provides critical insight into the attacker's post-breach activities and potential monetization strategies.

In response to these breaches, South Korea's financial regulator convened an emergency meeting to address the immediate threats and coordinate a response. President Lee Jae Myung has publicly called for a comprehensive investigation into the incidents, emphasizing the severity of the attacks on the nation's financial infrastructure.

Implications for Cybersecurity and AI

The ARTEX incidents underscore the evolving landscape of cyber threats, where AI language models, originally developed for beneficial applications, can be adapted for sophisticated hacking. The open-source nature of ARTEX and its reliance on publicly available AI models like DeepSeek means that similar tools could potentially be developed or modified by other malicious actors.

This event serves as a critical reminder for financial institutions and other organizations to continuously enhance their cybersecurity defenses, particularly against automated and AI-driven attack vectors. The rapid development and accessibility of AI technologies necessitate a proactive approach to security, focusing on detection, prevention, and rapid response to novel threats.

Conclusion

The breaches involving the ARTEX AI hacking tool against South Korean financial institutions, including Shinhan Bank, represent a significant cybersecurity event in late 2026. With over 25,000 records stolen and a national investigation underway, these incidents highlight the increasing sophistication of AI-powered cyberattacks and the urgent need for robust defensive measures across the financial sector.

Sources

• GitHub - CrackerCat/feed · GitHub
• gemsearch/index/development/gems/name_exact_weights.memory.json at master · floere/gemsearch · GitHub
• intel-codex/Security/Analysis/sop-forensics-investigation.md at main · gl0bal01/intel-codex · GitHub
• SoK of RWA Tokenization: A Systematization of Concepts,...