Chinese Hackers Use ARTEX AI to Launch Automated Attacks Against More Than 200 Organizations

Chinese-linked hackers have reportedly used artificial intelligence-powered tools to conduct automated cyberattacks against more than 200 organizations across 14 countries.

The campaign, which began on October 17, 2026, targeted government ministries, telecommunications providers, and organizations operating in the pharmaceutical, semiconductor, defense, nuclear, and financial industries.

According to cybersecurity researchers at CrowdStrike, the threat actor, tracked as Vapor Panda, used ARTEX, an open-source multi-agent AI penetration-testing framework, to coordinate multiple operations.

Investigators confirmed that at least nine organizations were successfully compromised, while password-spraying attacks and credential-scanning activities were detected against at least 12 additional high-value targets.

Confirmed victims included telecommunications companies in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, as well as pharmaceutical companies in the United States.

One particularly concerning incident involved a Greek government organization. Researchers reported that AI agents were used to forge an administrator authentication token and access email accounts using authentication keys obtained from an older mail-server directory export.

The attackers also reportedly used DeepSeek and another unidentified commercial language model to coordinate planning activities and manage multiple AI agents working across different targets.

ARTEX was originally developed as an open-source penetration-testing framework by Chinese developers. However, its growing association with real-world attacks led its creators to make the project proprietary.

Researchers say the campaign represents an escalation in the use of AI-assisted cyber operations, moving beyond individual intrusions toward multiple coordinated attacks directed by human operators.

The findings highlight how artificial intelligence can increase the speed and scale of cyber espionage operations.

Organizations are being urged to strengthen authentication systems, protect administrative credentials, monitor unusual login activity, and regularly review access permissions to reduce the risk of AI-assisted attacks.