Crowdstrike reported that a suspected single attacker used AI-powered hacking tools to breach multiple South Korean banks between late September and early October 2026, stealing large amounts of data. At Shinhan Bank alone, over 25,000 records containing names, contact details, income, and credit limits were stolen, prompting South Korea's financial regulator to hold an emergency meeting and President Lee Jae Myung to call for a thorough investigation.
The attacker utilized ARTEX, a Chinese open-source tool released on GitHub in July that employs AI language models like DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 for automated penetration testing. Researchers also discovered Claude Code session logs on the attacker's open directories, which revealed searches for Telegram groups intended for selling the stolen data.
Crowdstrike noted that this incident demonstrates how modern artificial intelligence tools enable a single individual to execute massive security breaches rapidly. This event highlights the growing cybersecurity risks associated with automated penetration testing software.