Hackers Used AI Coding Tools to Steal Data From South Korean Banks

Attackers used AI coding tools to help steal data from South Korean financial organizations between late September and early October 2026. Security researchers found the attacker's own working files exposed online. The files show how AI helpers were set up to support the break-ins.

What happened

CrowdStrike's October 7 investigation assessed, with moderate confidence, that the operator was Chinese-speaking and financially motivated. The activity has not been tied to a named hacking group. Compromised systems reportedly included a loan progress inquiry service for financial brokers and an employee mobile work-support platform. How the attacker first got in has not been disclosed.

What the exposed files showed

The files point to a tool called ARTEX and to Claude Code, an AI coding tool that lets a model write and run code. Hunt.io also found an open folder on a Hong Kong server holding 42 files. Key details from the research:

• Claude Code was started 510 times and ran 19 custom skills, with 147 uses in total.
• The skills covered scouting targets, testing logins, getting past firewalls and checking payment logic.
• DeepSeek v4.1-flash was the main AI model, with GLM-5.3 and Grok 4.6 as extras.
• Requests likely passed through xcai[.]pro, a proxy or reseller tied to the campaign.

Small scripts adjusted Claude Code so it could work with these other models. Researchers say that shows deliberate effort. Claude Code's presence does not mean Anthropic's models powered the attacks.

What is still unknown

Having a skill configured is not proof it was used on a Korean bank. A prepared exploit setup was also found, but it does not show that any particular bank was hit. Other files, such as cryptocurrency withdrawal scripts and phone research code, have no confirmed link to these breaches. The Cloud Security Alliance cautions that neither full attack autonomy nor a reconciled list of victims has been established.

What to do

The advice is aimed at defenders, but business owners can ask their IT teams or vendors about it:

• Review who can reach smaller, peripheral apps such as broker portals and staff mobile tools.
• Make sure the server checks permissions, not just the app screen.
• Investigate unexplained outbound connections to AI model resellers and proxy services.

Researchers also warn that a system matching ARTEX markers should not automatically be blamed on this operator.