The FBI released a flash alert on November 13, 2026, highlighting the use of the Artex tool by cybercriminals and nation-states. Artex automates several phases of cyber intrusions, from reconnaissance to data exfiltration, at machine speed.
Originally released on GitHub by 'Autumn-27' on July 26, 2026, Artex has been removed from the platform but continues to spread through community forks and archived copies. Over 1,600 publicly exposed Artex console instances have been identified, with total deployments likely much higher.
The tool has been implicated in attacks on South Korean and Japanese financial institutions. Microsoft reported its use by Chinese state-backed actors in a supply chain attack on ConnectWise, while Amazon found its use in large-scale credential theft by disparate Chinese-nexus threat groups.
Artex can integrate with AI models from OpenAI and Anthropic, and has been deployed against sectors such as financial services, government, technology, and healthcare. A backdoored version of Artex was downloaded over 9,000 times after the original was taken down.
The FBI noted that Artex enables threat actors with minimal technical expertise to conduct complex operations, allowing smaller groups to run concurrent intrusion campaigns at an unprecedented scale. Artex can exploit systems with less security attention, including partner portals and legacy services.
The last open-source release of Artex was version 0.3.15. The tool's developer, Li Puhua, stated that it was abused by malicious actors.