Offensive AI Reaches a Tipping Point: Check Point Reports 48% Surge in Attacks

Check Point Research's weekly Threat Intelligence Report for October 12, 2026 records an unprecedented acceleration in the threat landscape: 2,803 average weekly attacks per organization, a 48% year-over-year increase and a 53% jump for ransomware. The figure that conditions the reading, however, is not quantitative. It is qualitative: for the first time in a mainstream intelligence report, agentic AI tools built for security — automated pentesting, LLMs for assisted coding — appear systematically repurposed for offensive use, erasing the line between legitimate and illicit use of the same technologies.

ARTEX: When Agentic Pentesting Becomes a Weapon

The Check Point report documents the ARTEX campaign against South Korean financial institutions. The technical evidence, corroborated by CrowdStrike Intelligence in an analysis dated October 7, reveals an operational pattern that redefines tradecraft: a Chinese open-source agentic pentesting tool was reconfigured to automate reconnaissance and exploitation.

CrowdStrike identified IP 38.244.50[.]120 hosting an active ARTEX instance, CLAUDE.md files containing Chinese-language pentesting prompts, and exposed session histories in open directories — an operational error that enabled defensive intelligence collection. An IP associated with Hong Kong was linked to the infrastructure. The exact number of institutions hit "remains unconfirmed," according to the source; attribution to a specific Chinese threat actor is assessed with "moderate confidence" by CrowdStrike, which does not associate the campaign with a named adversary.

The breakout element is not the compromise itself, but the source of the tool. ARTEX is not proprietary malware: it is an open-source framework, publicly available, designed for red teaming and security audits. Its weaponization demonstrates that the offensive repurposing cycle has compressed until the latency between publication of a defensive tool and its adversarial field use has vanished.

"The use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution CrowdStrike has observed in adversarial tradecraft"
— CrowdStrike Intelligence

Hidden Prompt Injection: The New Vector for AI-Assisted Phishing

The Check Point report describes a phishing campaign that exploits corporate email AI assistants as an attack surface. The emails contain hidden instructions in HTML comments and invisible text — elements not rendered to the human user but processable by AI system parsers. The goal is to manipulate the assistant's behavior: authorize transfers, exfiltrate mailbox contents, or generate responses that legitimize fraudulent requests.

Cisco Talos analyzed related techniques in a campaign attributed to UAT-11985, with a phishing framework employing a hybrid HTTP/WebSocket architecture, sandboxed iframe, and pixel-perfect replication of Google Login interfaces. Detection occurs via browser language (zh-CN/zh-TW/EN). Talos notes that "the messages also exhibit characteristics consistent with AI-assisted content generation such as grammatically fluent but formulaic prose, excessive use of grandiose and abstract policy terminology." The source adds that it is not possible to conclusively determine generative AI use, but the pattern is consistent.

The Check Point report integrates this trend with a significant operational data point: 1 in 39 enterprise GenAI prompts is classified as high risk for sensitive data exposure. The report does not specify the classification methodology, but the number indicates a measurable and non-trivial attack surface for corporate AI adoption policies.

Four Critical Vulnerabilities with Active Exploits in the Patch Cycle

The report aggregates four vulnerabilities with high to critical severity, all with confirmed targeting or documented exploit conditions. The official data is as follows.

CVE-2025-64393 in Veeam Backup & Replication: CVSS 9.4, low-privileged users can execute arbitrary commands. The fixed build is 12.3.2.4934. CVE-2026-88779 in Citrix NetScaler: memory overflow in the SAML authentication path, CVSS 8.7, with vendor-confirmed targeted exploitation. The report does not specify patch availability for all affected versions. CVE-2026-76455 in Cisco NX-OS: improper access control with CVSS 9.8, per data in the dossier. CVE-2026-21589 in Atlassian Data Center: arbitrary file access with CVSS 9.3, allowing unauthenticated users to obtain administrative credentials across eight product line offerings.

The combination of these vulnerabilities with MFA interception techniques (hybrid HTTP/WebSocket man-in-the-middle, documented by Talos in the Taiwanese campaign) creates high-efficiency attack chains. The most complex chain is not required: a single flaw providing initial access, followed by real-time credential interception, is sufficient for full compromise.

Large-Scale Data Breaches: Denmark, Ukraine, Japan, Global Retail

The report documents multiple data breaches across government, education, retail, and financial sectors. In Denmark, the Central Register of Persons was exposed through a private supplier: approximately 8.8 million individuals with names, addresses, and national IDs. The brief does not specify the technical access method, reporting only that "unauthorized individuals exploited access provided to a private supplier."

ASOS suffered a cyberattack involving stolen employee credentials, access to third-party platforms, and unauthorized push notifications; the Xuanye group claimed responsibility. ATB, a Ukrainian retailer with approximately 7.9 million potentially exposed customers (names, addresses, passports, orders), received a $400,000 ransom demand from the DataSuckers group. ATB formally denied the data breach, stating that "The temporary message displayed on the website did not affect the security of your data"; the source provides no technical counter-evidence, nor is an independent audit available. The exact scale of the breach remains unconfirmed outside the attacker's claim.

Osaka Metropolitan University suffered a suspected ransomware attack with approximately 500 servers impacted and approximately 130,000 potentially exposed individuals. CyberXero, an AI-augmented access broker, targeted Ukrainian energy infrastructure with over 628,000 exposed individuals. FortiBleed compromised over 86,000 FortiGate firewalls in 194 countries, with access sold to ransomware affiliates (INC, Lynx, Payload).

Why This Matters

The dossier does not specify documented remediation measures for the ARTEX campaign or for hidden prompt injection techniques. Patch distribution for all Citrix NetScaler versions affected by CVE-2026-88779 is not documented. The report does not quantify the success rate of AI-assisted phishing techniques nor provide verifiable indicators of compromise for prompt injection in HTML comments.

Attribution of UAC-0099, UAT-11985, and the ARTEX threat actor to nation-states or specific groups is not confirmed in the dossier. The scale of the ATB data sale by DataSuckers is announced but unverified. The brief does not document the presence of secrets, SSH keys, source code, or specific credentials in compromised containers or systems.

The significant data point, despite these limits, is the convergence of three historically unprecedented trends within the same reporting window: open-source agentic AI tools repurposed offensively, prompt injection as a systemic vector against enterprise assistants, and hybrid AitM frameworks for real-time MFA interception. This convergence requires no hypothesis to be read: the technical conditions documented in the October 12, 2026 report indicate that the offensive AI experimentation phase is over.

Frequently Asked Questions

Information is based on the cited source and current as of publication.

Sources

• https://research.checkpoint.com/2026/12th-october-threat-intelligence-report/
• https://therecord.media/atb-ukraine-cyberattack-ransomware
• https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
• https://blog.talosintelligence.com/uat-11985/

Information is based on the cited source and current as of publication.

Sources