Guard data as AI tools fuel global cyberattacks for financial gain

Organizations across multiple global sectors face exposure from a sophisticated cyberattack that leveraged artificial intelligence to automate penetration testing. Zscaler ThreatLabz confirmed in October 2026 that the campaign targeted entities far beyond the South Korean financial institutions initially identified. The investigation revealed a widespread effort to compromise systems and extract valuable data from victims in diverse industries.

Which organisations and data were targeted?

The attack group focused on organisations in various industry sectors around the world. While early reports highlighted South Korean financial institutions, Zscaler ThreatLabz discovered that the scope was much broader. Prompt histories recovered from the attackers' systems showed requests for bulk personal and transaction data. This suggests the operators were interested in sensitive customer information and financial records held by these global targets.

How did the attackers use AI tools?

The threat actors combined the ARTEX penetration testing framework with several AI coding assistants, including Claude Code, Codex, and Grok. They configured ARTEX to use models such as DeepSeek, GLM, and Grok through an OpenAI-compatible gateway. Custom scripts allowed the operators to share instructions and hand off tasks between different AI sessions. This setup enabled the AI models to divide investigation tasks and review one another’s findings autonomously.

What was the operator's working environment?

The attackers used a work server to store project files, scripts, and a local deployment of ARTEX. A jump server at IP address 38.244.50.120 served as the default route for connections to targets. The operator delegated research tasks to Grok on this server and instructed a separate AI session to review the findings. Three custom scripts synchronized shared AI instructions and supporting files across accounts to preserve investigation context and progress.

What motivated the attackers?

The evidence points to financial motivation behind the campaign. Prompt histories revealed requests for bulk personal and transaction data, alongside questions about selling stolen data. This indicates the operators intended to monetise the information they extracted from compromised systems. The recorded prompts spanned from August 4 through October 4, 2026, showing a sustained period of activity before the investigation was published.

What affected people can do

Individuals and employees should monitor their bank statements and credit reports for unauthorised transactions or changes. Check email inboxes for unexpected password reset requests or login alerts from financial services. Be wary of phishing emails that claim to be related to this security incident, as criminals often exploit such news to trick victims into revealing more credentials. Verify any urgent communications directly with your institution through official channels rather than clicking links in suspicious messages.

Background: Login alerts

Review login alerts by checking device identity, geographic plausibility, and timestamp consistency. Ignore alerts from known automated services but block any access from unfamiliar hardware or impossible locations. Set up secondary verification for high-value accounts to reduce alert fatigue.

Read the full guide: Login Alerts Checklist: How to Spot Real Threats vs Noise

What to do and how to stay safe: ARTEX

• Review recent account activity for unrecognised logins or data access patterns that could indicate a breach.
• Enable multi-factor authentication on all critical accounts to add a layer of security beyond just passwords.
• Monitor financial statements closely for small or unusual transactions that might signal stolen data is being used.
• Wait for official updates from your organisation or service provider before assuming your specific data was compromised.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers successfully steal data from all targeted organisations?

The source material does not confirm successful data exfiltration from every target, but prompt histories show requests for bulk personal and transaction data.

Which specific AI models were used in the attack?

The operators used DeepSeek, GLM, and Grok models, configured through an OpenAI-compatible gateway within the ARTEX framework.

When did this campaign take place?

Recorded prompts from the attackers' systems span from August 4 through October 4, 2026, according to Zscaler ThreatLabz.