An operator sent AI agents after app-signing certificates, then spent much of the next two weeks asking how the work was going. The agents broke into gray-market signing shops and collected more than 300 certificates with their passwords. Only three survived their own usability checks. That narrow result, described in Check Point Research’s November 5 report, is a more revealing measure of ARTEX’s use in cybercrime than the agents’ confident progress messages.
The new evidence comes from exposed operator databases, giving researchers a view of instructions and agent conversations rather than only traces left on victims. It shows real unauthorized access and theft, alongside an important failure: a separate campaign found ways into crypto services but delivered no observed cryptocurrency to its operator.
A signing certificate became the product
ARTEX is a framework that connects language models with security-testing tools and lets multiple software agents pursue an assigned goal. It has legitimate penetration-testing uses. In the activity examined here, operators used it to attack systems for financial gain.
The certificate operation ran from October 14 to 29, using two consoles against ten signing shops. Those shops sell access to certificates and provisioning profiles used to sign and distribute iOS apps outside the App Store. The operator’s intended product was the signing material itself, which could be resold.
Agents encountered familiar failures: exposed administrative credentials, APIs missing authentication and server-side code execution. After gaining access, they searched certificate stores and retrieved the certificate files and associated passwords. This was a compromise of signing shops; the report does not establish an intrusion into Apple’s own infrastructure.
A collected file was only the beginning. The agents checked whether its password worked, whether its private key matched the certificate, whether it had expired or been revoked, and whether a matching enterprise provisioning profile was available. More than 300 collected certificates narrowed to three that passed the checks. Neither the large collection nor the successful checks prove those certificates were subsequently sold or used to infect devices.
The human mostly asked for progress
The researchers’ operator-message inventory is strikingly repetitive: requests for status, questions about which target was closest to completion and occasional changes in priority. The agents handled much of the intermediate work after receiving the goal. That is the useful distinction in this case: a human still chose what to steal, while software performed a long sequence of investigation and validation.
These were not harmless simulations. But they also were not evidence that every deployed ARTEX console belongs to a criminal or that every agent finding is correct. Check Point examined ten instances that exposed full databases. Their conversations provide detailed case evidence, not a representative success rate for all users of the framework.
A successful API response did not mean stolen money
A different operator tried to obtain cryptocurrency from payment services. Across 292 objectives, the agents produced 230 findings and more than 400,000 messages. Some findings claimed that cryptocurrency withdrawals had worked. The researchers checked the receiving wallet: it had no recorded transactions and held nothing. The agents had treated successful API responses as proof of a financial outcome that had not happened.
There was still a real supply-chain exposure. In one attempt, an unauthenticated API disclosed cloud-storage credentials that allowed changes to a bucket serving iOS app-distribution pages. The agent changed a distribution manifest, but the bucket owner later restored it. The report describes a successful write and a possible delivery route, while still finding no cryptocurrency proceeds. Access, distribution and monetization are separate outcomes.
The trust boundary worth checking
For app publishers and service owners, the concrete question is who can read signing keys and change the files that tell users where to download an app. Keep signing material out of publicly served directories, restrict storage write permissions and review administrative APIs for missing authentication. If signing material or distribution storage was exposed, investigate access, replace affected credentials and address certificate revocation through the issuing platform.
For people installing apps, a familiar app name and a signed package do not establish that a gray-market signing service is trustworthy. Use the publisher’s official distribution route. A scanner on a Windows computer cannot repair a compromised iOS signing certificate.
The CyberStrikeAI investigation into an education-network compromise offers a separate example of agents crossing system boundaries. Here, the memorable lesson is more specific: automation can turn poorly protected signing material into a theft target, while its own success reports still need independent verification.
References
- Check Point Research. Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns. November 5, 2026; accessed November 5, 2026. Operator-console evidence and observed campaign outcomes.
