AI-powered hacking tools enabled a likely single attacker to breach multiple South Korean banks
decoder ·
Crowdstrike has reported that a likely single attacker, suspected to be Chinese-speaking, breached multiple South Korean financial institutions between late September and early October 2026. The intruder utilized ARTEX, an open-source AI-powered hacking tool that leverages large language models like DeepSeek v4.1-flash and GLM-5.3 for automated penetration testing. This attack resulted in the theft of sensitive data from Shinhan Bank alone, where over 25,000 records containing personal and financial details were compromised. Evidence found on the attacker's servers included Claude Code session logs indicating plans to sell the stolen information via Telegram groups. The incident highlights how AI tools can empower individual actors to execute massive cyberattacks within short timeframes. In response to the breach, South Korea's financial regulator convened an emergency meeting, and President Lee Jae Myung ordered a thorough investigation. Security experts have long warned about the risks associated with such AI-driven automation in cybersecurity threats.
decoder