ARTEX: How an AI Hacking Agent Attacks Web Apps, and What to Lock Down

Your JavaScript files can be a map of your application. In activity investigated by Wiz, ARTEX-associated tooling downloaded public source maps and configuration files, then requested internal API routes named only in those maps.

For a website or SaaS owner, that is a useful starting point: check what your deployment reveals before concentrating only on the login screen. This guide separates reported activity from practical checks you can assign to your team.

What happened

ARTEX is no longer associated with just one reported campaign. CrowdStrike describes VAPOR PANDA's activity as separate from Storm-0940's use of the framework. Here is the public timeline so far.

Be careful with compromise counts. CyberScoop reported about 140 compromised sensitive targets, based on CrowdStrike's estimate combining confirmed compromise with moderate-confidence indications of successful intrusion. CrowdStrike's own blog confirms post-exploitation at nine organizations. These are different evidence thresholds, not interchangeable counts of confirmed breaches.

What ARTEX is and how it works

ARTEX began as an open-source autonomous penetration testing framework. An operator supplies a target and objective. A planner selects the next action, workers use tools such as nmap, curl and Impacket, and results enter a shared graph of assets and findings, according to Wiz.

Autonomous does not mean humans disappear. CrowdStrike observed operators giving instructions in Chinese at decision points, including directing web-shell creation and credential extraction. Agents pursued parallel paths and changed direction when an approach failed.

This diagram summarizes the repeatable playbook Wiz described. It is a reading aid, not a claim that every intrusion follows a fixed sequence.

flowchart LR
    A[Map application] --> B[Probe authentication]
    B --> C[Attack identity flows]
    C --> D[Abuse account recovery]
    D --> E[Test tenant isolation]
    E --> F[Adapt infrastructure]
    F --> B

Why speed changes things

CrowdStrike's Adam Meyers told CyberScoop that hands-on-keyboard activity typically reaches up to 40 commands an hour, while ARTEX could exceed 1,500. Treat this as an attributed comparison, not a universal benchmark for every agent or attacker.

Microsoft observed multiple instances of initial targeting progressing to privileged cloud access in under three hours. Separately, Wiz saw sessions lasting 24–30 hours, replacement IP addresses appearing within minutes of blocks, and switches to another endpoint when a login page rate-limited requests.

The operational lesson is to prepare detection and containment before an alert arrives. Assign someone who can review identity events, disable an exposed credential and coordinate application changes. An IP block should prompt a wider investigation of the account and request pattern.

What the agent does first to a web app

Wiz's log examples include the following paths. Wiz shortened the first source-map filename in its post. These are request examples, not a script to run against someone else's site.

GET /packs/js/main-...js.map
GET /assets/config.json
GET /env.js
GET /swagger/?format=openapi
GET /Account/ValidateUserName?UserName=admin
GET /company/1/logins
GET /zzz-nonexistent-xyz123

The first requests gathered application context: source maps, runtime configuration and API documentation. Wiz then observed requests to internal API routes named only in the source maps. The username-validation request tested account discovery. A disposable-mailbox registration preceded tenant-isolation probing, including the company-logins request, which returned 403. The nonexistent path established a baseline 404 response before fuzzing. These details come from Wiz.

A request is not proof of a successful exploit. The 403 matters: preserve the response and surrounding sequence rather than labelling every probe a breach. For your own deployment, ask whether each public file is intentional and whether its contents expose anything useful beyond the intended public interface.

Lock down these 10 things this week

The observed behaviors below are attributed. The actions and verification suggestions are Protego's defensive guidance; they are not claims that every control was recommended by every vendor.

1. Remove production source maps from public access. Wiz observed source-map retrieval followed by discovery of internal routes. Keep debugging artifacts in your private workflow and verify that old deployment paths are also inaccessible. Observed behavior: Wiz.
2. Remove secrets from public configuration. Review env.js, config.json and similar runtime files. Public configuration should contain only values you intend visitors to read. If a secret was exposed, follow the rotation step below. Observed configuration retrieval: Wiz.
3. Make API documentation public only by choice. Review Swagger and OpenAPI access alongside the routes they describe. Restrict unintended documentation exposure; continue checking authorization on the APIs themselves. Observed documentation retrieval: Wiz.
4. Control login and recovery together. Apply per-account and per-endpoint rate limits and lockout controls to login, password reset and related recovery flows. Test the policy across endpoints. Wiz saw agents switch endpoints after rate limiting and probe reset, activation and recovery functions. Observed behavior: Wiz.
5. Give valid and invalid usernames the same outward response. Review username checks and recovery messages for account disclosure. Verify the response behavior with owned test accounts. Wiz recorded explicit username-enumeration requests. Observed behavior: Wiz.
6. Review token and federation validation. Reject JWTs using alg: none, validate OAuth state, and enforce SAML signature validation. Wiz saw unsigned JWT and malformed OAuth-state probes; CrowdStrike described an unsigned SAML assertion chained with an XXE flaw. Wiz, CrowdStrike.
7. Test tenant isolation after ordinary sign-up. With controlled accounts, check whether changing an object ID exposes another tenant's records, an insecure direct object reference or IDOR. Review disposable-email sign-up as an abuse path without treating an email-domain rule as authorization. Wiz observed temporary-mailbox registration and predictable-ID probes. Observed behavior: Wiz.
8. Require IMDSv2 and narrow cloud-role permissions. Review roles that can execute commands as well as metadata access. CrowdStrike described a chain reaching cloud instance metadata and recommended IMDSv2 plus restrictions on roles' command-execution permissions. CrowdStrike.
9. Rotate keys after exposure, including historical copies. Include signing keys, preauthentication keys and service credentials in the review of suspected exposure. CrowdStrike described unrotated keys from a 2022 mail-server directory export being used to forge an administrator token, and explicitly includes backups and exports in its rotation guidance. CrowdStrike.
10. Strengthen Okta and Entra account protection. Enable phishing-resistant MFA as general defensive guidance and review spray detection across accounts and IPs. Wiz observed password spraying against both providers. Microsoft's earlier spray had no observed successful authentication; it must not be merged with the downstream application-abuse findings. MFA also does not replace application-credential review. Wiz, Microsoft.

Signals to look for in your logs

Use sequences and context. Wiz warns that many observed user agents are common and noisy when hunted alone.

If you run Microsoft 365 with ConnectWise apps

If you run Microsoft 365 or ConnectWise, this website checklist does not replace a tenant and RMM investigation. Microsoft says affected applications already had access, allowing activity without interactive user sign-in, and recommends preserving evidence and reviewing credential and privilege changes. Its figure of more than 2,250 tenants describes attempted sign-ins, not confirmed compromises.

Check your own site

Start with the free Protego vulnerability scanner. It runs a light, mostly passive external check of headers, TLS and exposure signals. Deep Scan checks include exposed .env paths, Swagger/OpenAPI documents and JavaScript source maps. Choose one finding, fix it, then rescan. It is not a pentest and does not verify your authenticated tenant boundaries.

For a deeper optional assessment, Protego sells a hosted Strix assessment for USD 14.50 during early access. It is automated and unauthenticated, scoped to one DNS-verified site. That scope matters when deciding what still needs manual or authenticated testing.

ARTEX and Strix are both autonomous pentest agents. The difference is authorization: testing should have the site owner's permission and an agreed scope. Our commercial interest is explicit here: Protego sells the hosted assessment. Start with the free check if you need to understand public exposure first.

FAQ

Is ARTEX a new vulnerability?

No. Microsoft describes a penetration testing framework. Review the exposed files, identity controls and permissions it can investigate rather than looking for one ARTEX patch.

Did the reported attacks all succeed?

No. Wiz says most observed attempts failed. CrowdStrike's confirmed post-exploitation count and CyberScoop's broader estimate use different thresholds, as explained above.

Will blocking the published IPs stop it?

Do not rely on that alone. Wiz observed IP rotation after blocking and endpoint changes after rate limiting. Investigate the surrounding activity and affected accounts.

Are public API docs automatically a security flaw?

Decide whether publication is intentional. Wiz observed documentation used for application mapping. Protego's recommendation is to review that exposure while independently testing API authorization.

Can a clean scanner result rule out compromise?

No. Protego's scanner is a light, mostly passive external check, not an incident investigation or pentest. Use its findings to guide remediation; use application, identity and cloud evidence to investigate suspected access.

Sources

• Microsoft: Storm-0940, ARTEX and the ConnectWise compromise
• Wiz: ARTEX in the wild
• CrowdStrike: VAPOR PANDA's ARTEX campaign
• CyberScoop: Reporting on CrowdStrike's ARTEX findings

Facts checked November 3, 2026.