Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft

Chinese-nexus threat actors used ARTEX, an open-source agentic penetration-testing framework, to steal large language model API credentials and feed them back into infrastructure powering further attacks.

Amazon Threat Intelligence uncovered the financially motivated campaigns after its MadPot decoy network captured requests containing the agents’ operational memory between October 3 and November 5, 2026.

Sensors impersonating LLM inference APIs received system prompts, tool histories, knowledge-graph state, and campaign records. Amazon assessed ARTEX usage and Chinese-nexus attribution with moderate confidence, but could not independently verify the outcomes described in agent-generated records.

Hackers Use Stolen API Keys to Power ARTEX AI Agents

ARTEX distributed operations across planner, worker, verification, and compression agents sharing a persistent knowledge graph. Standing prompts established objectives and targeting restrictions, while agents performed reconnaissance, exploitation, credential validation, and cloud-permission assessment.

Operators used simplified Chinese instructions, China time-zone settings, proxy requirements, and exclusions covering mainland China and government domains.

The principal campaign created a self-sustaining inference loop: stolen provider keys entered the framework’s model gateway, financing the agents’ continuing search for additional credentials rather than requiring operators to purchase equivalent computing capacity.

Targets included One API, New API, Veloera, Sub2API, and LiteLLM AI gateways, alongside Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat, and Ollama.

These platforms concentrate upstream model-provider credentials, making exposed management interfaces particularly valuable.

A product-specific exploitation playbook covered default master keys, uninitialized installations, anonymous configuration endpoints, and authentication bypass through the isCliRequest header in One API-family systems.

Agents also searched client-side JavaScript, source maps, debug routes, and environment files for secrets that could unlock multiple downstream accounts.

The playbook incorporated Langflow remote code execution tracked as CVE-2025-3248 and RAGFlow’s CVE-2026-28797. URL-fetch functionality supplied another route through cloud metadata SSRF, potentially exposing workload credentials.

Discovery extended across certificate-transparency records, GitHub event archives, npm and PyPI packages, container layers, paste sites, and Telegram.

Agents classified credentials as L1 leads, L2 working API calls, or L3 quantified impact, while treating secrets exposed for over 30 days as lower-value inventory. Cloud access prompted identity validation, storage enumeration, and searches for premium models and secret stores.

A separate campaign targeted two cryptocurrency exchanges using real-time deepfake injection against know-your-customer liveness checks. Agents reverse-engineered a vendor’s face-detection event stream and movement coordinates.

Their closest recorded attempt positioned a face within seven pixels of its target, yet every documented deepfake failed server-side verification.

Another session achieved 11.5 frames per second on one consumer GPU by splitting the model and reducing memory copies. Document-forgery work fabricated camera EXIF metadata while preserving JPEG quantization tables to resemble unedited photographs.

Amazon emphasized that these operations relied on established weaknesses, not novel exploitation techniques. Defenders should remove default credentials, patch exposed platforms, rotate leaked secrets, restrict management and inference endpoints, and investigate unexpected model spending.

Published indicators include 104.28.225[.]223 for credential theft and 212.107.28[.]51 for cryptocurrency fraud; organizations should correlate these addresses with authentication, application, and cloud audit telemetry.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team