Hunt: Check Point found 1,608 live, internet-exposed ARTEX agentic-hacking consoles, and 10 leaky ones show criminals running near-autonomous campaigns on DeepSeek Flash
- Campaign 1: an operator ran two consoles from Oct 14 to 29 (DeepSeek v4.1 Flash and Kimi K3.1 Pro, about 36 billion tokens) against 10 gray-market iOS signing shops, pulling 300+ .p12 certificates with passwords; three passed the agents' own validity checks.
- Campaign 2: agents were told to drain USDT from 292 crypto payment domains and swap in the attacker's deposit address. CPR says the wallet stayed at $0 and several claimed successes were hallucinations, though agents did gain write access to an S3 bucket serving iOS app landing pages.
- Campaign 3: agents hit 13 gaming-account shops and found 190,000+ Honor of Kings credential sets in a static web-root file, about 3.3% still valid.
- Models: Chinese models dominated; CPR saw guardrails trip only on Anthropic's Opus 5.5, after which the operator switched models.
- Defend: agents tend to probe every endpoint, so hunt for hardcoded secrets in front-end bundles, unauthenticated APIs and world-writable buckets; residential-proxy traffic was common, so IP blocks alone won't stop it.
Sources: Check Point Research: Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Nov 5)