Attackers Use ARTEX and Claude Code to Support Attacks Against Financial Organizations and Exfiltrate Data

Researchers from CrowdStrike disclosed a campaign targeting multiple financial organizations between late September and early October 2026. Evidence indicated data exfiltration from compromised systems during this period. Attackers utilized ARTEX, an open-source agentic penetration testing tool, along with Claude Code and other Large Language Models to conduct operations. Researchers found evidence in attacker-controlled infrastructure, including session histories, configuration files, and memory data related to the tools used. The activity is linked to attacks against several financial organizations, though the exact number of affected organizations remains unconfirmed.
The attack workflow involved using ARTEX for automated penetration testing and attack execution, assisting with reconnaissance, vulnerability discovery, planning, and tool execution. Large Language Models, including Claude Code, supported activities across related systems and infrastructure, and connections were routed through multiple proxy services. Searches were also observed for channels intended for publishing or selling the obtained data. The evidence suggests the activity was financially motivated.
Organizations utilizing critical internet-facing services are advised to review external systems, reassess authentication controls, and examine logs for scanning activity, unusual proxy use, and anomalous outbound data transfers. If compromise is suspected, immediate investigation into data scope, credential revocation, and incident response are necessary. The case demonstrates the capability of agentic AI tools to accelerate multi-stage attack coordination.

* Researchers from CrowdStrike disclosed a campaign targeting multiple financial organizations from late September to early October 2026.
* Attackers used ARTEX, an open-source agentic penetration testing tool, with Claude Code and multiple Large Language Models (LLMs) for operations.
* Evidence was found in attacker infrastructure, including Claude Code session histories, ARTEX configuration files, and Claude Memory data.
* The activity linked to attacks against several financial organizations.
* ARTEX was used for an automated penetration testing and attack workflow, assisting with reconnaissance, vulnerability discovery, attack planning, and execution of security tools.
* Attackers used Claude Code and other LLMs to support activities across related systems and infrastructure.
* Connections were routed to targets through multiple proxy services.
* Researchers observed searches for channels to publish or sell obtained data.
* The activity was assessed as likely financially motivated based on available evidence.

The narrative highlights the emerging operational shift where agentic AI tools are integrated into offensive cyber operations, moving beyond simple automation to orchestrate complex, multi-stage activities. The use of specialized tools like ARTEX alongside general-purpose LLMs illustrates a convergence between deep technical tooling and abstract planning/execution facilitated by AI. The focus on finding evidence within the AI's own artifacts (session histories, memory data) underscores a critical vulnerability: the potential for these powerful tools to leave forensic breadcrumbs that can be exploited or analyzed by defenders.
The implication for human agency lies in the speed differential created; the combination of automation and LLM assistance drastically reduces the time required for reconnaissance, planning, and execution, presenting an asymmetrical challenge to traditional defense mechanisms. The motivation, assessed as financial, points toward a commodification of offensive capabilities facilitated by these technologies. This forces a re-evaluation of security strategies away from perimeter defense toward continuous validation of internal operational integrity, specifically examining the artifacts generated by complex software interactions.
What assumptions underpin the immediate response urged to organizations? Does focusing solely on log anomalies and external systems risk overlooking systemic dependencies within the AI toolchain itself? If these agentic workflows become standard for threat actors, how do security architectures adapt to securing the "logic" and context provided by LLMs rather than just the endpoints they connect to? What protocols are necessary to manage the trust and provenance of code and memory used in attack workflows?