Amazon Threat Intelligence says threat actors used ARTEX, an open-source agentic AI penetration testing framework, to run automated cybercrime campaigns that stole API keys for AI models and tried to defeat cryptocurrency exchange identity checks with real-time deepfakes. The findings, published Nov. 13 on the AWS Security Blog by CJ Moses, CISO of Amazon Integrated Security, cover reconnaissance, vulnerability testing, credential theft, cloud-privilege expansion and fraud attempts across what Amazon describes as hundreds of targets.
Amazon captured the activity through MadPot, its globally distributed network of decoy threat sensors, between Oct. 3 and Nov. 5, 2026. The sensors posed as popular LLM inference APIs, and the ARTEX agents sent them requests carrying their own campaign context: system prompts, tool histories, knowledge-graph state and reported findings. Amazon said it did not observe the operations as they happened and cannot verify the outcomes the agents reported.
Amazon attributes the activity to ARTEX with moderate confidence, based on prompt references to the tooling. It also assesses with moderate confidence that the operators are Chinese-nexus actors, citing simplified Chinese in prompts, China time-zone configurations, targeting consistent with Chinese interests and tooling mostly used by Chinese-nexus groups. Amazon assesses them as disparate groups rather than a single crew. Their standing instructions excluded mainland China targets and government domains and required all outbound traffic to run through proxies.
Key facts
- 01Amazon's MadPot decoy sensors captured ARTEX agent campaign records between Oct. 3 and Nov. 5, 2026, covering hundreds of targets.
- 02Amazon attributes the activity to Chinese-nexus actors with moderate confidence and assesses them as disparate groups.
- 03Stolen AI API keys were routed into the framework's own model gateway to pay for continued credential theft.
- 04Named targets include LiteLLM, One API, Dify, Langflow, RAGFlow, Open WebUI and Ollama, plus CVE-2025-3248 and CVE-2026-28797.
- 05Deepfake attempts against two crypto exchanges reached 11.5 fps on one consumer GPU, but the liveness vendor rejected every recorded try.
The framework splits work among planner, worker, verification and compression agents that share a persistent knowledge graph. Each agent reads from that graph and writes its results back. Operators set mission objectives, targeting rules and operational constraints through standing instruction prompts.
The first campaign focused on stealing credentials for AI models at industrial scale, likely so the operators could use those models at someone else's expense. Amazon says stolen keys were loaded into the framework's own model gateway and then paid for the agents' continued credential hunting, making the operation self-sustaining. The agents prioritized keys for premium frontier models over general cloud permissions.
The common method was to find internet-exposed AI applications, extract the upstream provider keys they hold, validate them and store them in a managed pool. Named targets include LLM gateways and proxies such as One API, New API, Veloera, Sub2API and LiteLLM, and AI application builders including Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama. Aggregator apps were preferred because one weak management interface can expose many downstream accounts.
The agents' playbook covered unclaimed fresh installs, anonymous management and provider-configuration endpoints, default admin credentials including the LiteLLM default master key, CVE-2025-3248 in Langflow, CVE-2026-28797 in RAGFlow, an authentication bypass via the isCliRequest header in One API-family systems, and SSRF through URL-fetch features to reach cloud metadata services. They also hunted secrets in client-side JavaScript, source maps, debug routes and environment files, as well as GitHub archives, npm and PyPI packages, container image layers, paste sites and Telegram channels.
Findings were graded in three tiers: L1 for a lead, L2 for a confirmed working API call and L3 for quantified impact such as readable data or spendable balance. Keys that had been publicly exposed for more than 30 days were treated as low-value inventory. One parallel operation worked through a fixed sequence of countries and ranked enterprise production sites above personal projects.
The second campaign targeted two cryptocurrency exchanges. Agents generated real-time deepfake video to pass live selfie checks and forged ID photos to pass document checks, after reverse-engineering one verification vendor's liveness protocol, including its face-detection event stream and movement-prompt coordinate system. The best recorded attempt completed the full movement sequence with the face within 7 pixels of the target, but the vendor's server-side verdict rejected the deepfake in every recorded attempt.
A separate session built a real-time deepfake pipeline on a single consumer-grade GPU using an open-source face animation model, reaching 11.5 frames per second by splitting the model and avoiding unnecessary GPU memory copies. For document forgery, the agents built synthetic camera metadata matching the JPEG's real dimensions and preserved the original compression tables so edited images looked untouched at the file level. At least four agent sessions ran at once on cash-out research, account balances, the deepfake pipeline and the verification bypass, sharing findings through cross-session tools.
Amazon says none of the techniques were new; what changes is the speed and persistence of the attackers. The failures exploited were default or hardcoded credentials, keys left in code and public artifacts, unauthenticated interfaces and inference endpoints, and unpatched software. Amazon recommends assuming exposed secrets will be found quickly, putting AI applications, model gateways and inference endpoints under the same controls as other production systems, and watching for unexpected AI spend.
Amazon said it notified AWS customers whose resources were referenced where appropriate. Because it could not confirm activity against other organizations, it published 11 IP-address indicators of compromise, first seen between Oct. 14 and Nov. 2, so other defenders can check their own logs.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
