---
title: Hunt: Check Point found 1,608 live, internet-exposed ARTEX agentic-hacking consoles, and 10 leaky ones show criminals running near-autonomous campaigns on DeepSeek Flash | ctxsec
url: https://ctxsec.com/items/hunt-checkpoint-artex-operator-consoles-1608-exposed-p12-cert-heist-gaming-creds
description: "CPR counted 2,557 systems that host or hosted ARTEX panels. Ten misconfigured instances exposed their full databases, showing operators set a goal and then mostly just asked for progress while agents exploited hardcoded admin passwords in JavaScript bundles, unauthenticated APIs, command injection, SSTI and IDOR."
status: "confirmed research (Check Point Research, Nov 5)"
published: 2026-11-05
---

> CPR counted 2,557 systems that host or hosted ARTEX panels. Ten misconfigured instances exposed their full databases, showing operators set a goal and then mostly just asked for progress while agents exploited hardcoded admin passwords in JavaScript bundles, unauthenticated APIs, command injection, SSTI and IDOR.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-checkpoint-artex-operator-consoles-1608-exposed-p12-cert-heist-gaming-creds.md)

confirmed research (Check Point Research, Nov 5)

2026-11-05

### Hunt: Check Point found 1,608 live, internet-exposed ARTEX agentic-hacking consoles, and 10 leaky ones show criminals running near-autonomous campaigns on DeepSeek Flash

- **Campaign 1:** an operator ran two consoles from Oct 14 to 29 (DeepSeek v4.1 Flash and Kimi K3.1 Pro, about 36 billion tokens) against 10 gray-market iOS signing shops, pulling 300+ .p12 certificates with passwords; three passed the agents' own validity checks.
- **Campaign 2:** agents were told to drain USDT from 292 crypto payment domains and swap in the attacker's deposit address. CPR says the wallet stayed at $0 and several claimed successes were hallucinations, though agents did gain write access to an S3 bucket serving iOS app landing pages.
- **Campaign 3:** agents hit 13 gaming-account shops and found 190,000+ Honor of Kings credential sets in a static web-root file, about 3.3% still valid.
- **Models:** Chinese models dominated; CPR saw guardrails trip only on Anthropic's Opus 5.5, after which the operator switched models.
- **Defend:** agents tend to probe every endpoint, so hunt for hardcoded secrets in front-end bundles, unauthenticated APIs and world-writable buckets; residential-proxy traffic was common, so IP blocks alone won't stop it.

Sources: [Check Point Research: Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Nov 5)](https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/)