On 29 October 2026, IT Brief reported CrowdStrike research describing a China-linked threat actor, tracked as Vapor Panda, using the ARTEX agentic AI framework to attack more than 200 organisations in at least 14 countries. BleepingComputer covered the findings on 2 November. According to that reporting, the campaign began on 17 October 2026, CrowdStrike confirmed post-exploitation activity at nine organisations, and at least 12 more faced password spraying and credential scanning. A human operator gave instructions in Chinese while planning and worker agents, running on DeepSeek and an unidentified second language model, carried out reconnaissance, exploitation and credential theft. The identity detail stands out: BleepingComputer reports that in an attack on a Greek government body, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. Victims named by sector include telecoms, government ministries and pharmaceutical firms. CrowdStrike advises rotating signing, preauthentication and service credentials after suspected exposure.
Key takeaways
- CrowdStrike says Vapor Panda used ARTEX against more than 200 organisations in at least 14 countries from 17 October 2026, with post-exploitation confirmed at nine, according to IT Brief and BleepingComputer.
- BleepingComputer reports that agents forged an administrator token at a Greek government body and read mailboxes using authentication keys taken from a 2022 mail-server directory export.
- Other credential abuse reported by IT Brief includes stolen Local Administrator Password Solution credentials at a pharmaceutical firm and a cloud metadata exposure that yielded a role able to issue admin commands to thousands of instances.
- Victims are described by sector and country, not by name. CrowdStrike's own report, published on 29 October 2026, confirms the headline figures and the forged administrator token in the Greek government intrusion.
- The identity lesson: old signing and authentication keys do not expire on their own. Keys left in a years-old export were enough for an agent to mint administrator access.
At a glance
| Organisations | More than 200 targeted in at least 14 countries; post-exploitation confirmed at nine, including telecom providers in the United States, Belgium and the Philippines, government bodies in Greece, the Middle East and Latin America, and US pharmaceutical firms (names not disclosed) |
|---|---|
| When | Campaign from 17 October 2026, observed by CrowdStrike over 11 days; first reported 29 October 2026 (IT Brief); BleepingComputer coverage 2 November 2026 |
| Attacker | Vapor Panda, a China-linked actor as tracked by CrowdStrike, using ARTEX with DeepSeek and a second unidentified model, directed by a human operator |
| Entry point | Vulnerability exploitation, web shells, password spraying and credential scanning, according to reporting of CrowdStrike's findings |
| Identities abused | A forged administrator token and mail-server authentication keys (Greek government body), LAPS credentials, a cloud role obtained through metadata exposure, domain administrator credentials sought |
| Impact | Mailbox access at a government body; compromise of telecoms, ministries and pharmaceutical firms; BLOODALCHEMY backdoor deployed against government entities |
| Category | NHI, Agentic AI and AI agents. Incident class: Confirmed AI-agent breach (campaign reported by CrowdStrike via press, victims unnamed) |
What happened
ARTEX is a multi-agent AI penetration-testing framework. BleepingComputer says it was released as open source and later made proprietary after it was used in real attacks, including a campaign against South Korean financial institutions. Zscaler ThreatLabz published research on 21 October 2026 describing a Chinese-speaking operator who combined a customised ARTEX framework with commercial coding assistants and several models. Zscaler did not tie that operator to Vapor Panda, and its prompt records describe targets rather than confirmed victims, so it is background here rather than evidence about this campaign.
According to IT Brief's report of CrowdStrike's findings, Vapor Panda has focused since 2021 on government, think tank, energy and extractive organisations, and this campaign is its first observed use of AI-driven intrusion tooling. CrowdStrike's OverWatch team saw activity from a single ARTEX controller over 11 days from 17 October 2026. Planning agents ran on DeepSeek and a second commercial model CrowdStrike could not identify, while a human operator issued instructions in Chinese and stepped in at key decision points. The agents carried out reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials and tried alternative paths when one failed. BleepingComputer reports that operators told the agents to skip Windows hosts protected by CrowdStrike's own Falcon sensor. In one intrusion the planning agents consumed about 1.4 billion input tokens, by the researchers' estimate.
The credential findings are the reason this campaign belongs on an NHI list. BleepingComputer reports that at a Greek government organisation, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. IT Brief reports that the attackers obtained Local Administrator Password Solution credentials at a pharmaceutical organisation, sought domain administrator passwords, and, in a US pharmaceutical intrusion, used a cloud metadata exposure to obtain credentials for a role that could issue administrative commands to thousands of instances. CrowdStrike also found the BLOODALCHEMY backdoor, first documented in October 2023, used against government entities in Latin America and the Middle East.
CrowdStrike's assessment, as quoted by BleepingComputer, is that the campaign "marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator." IT Brief reports CrowdStrike's view that China-linked adversaries are "highly likely to continue adopting agentic frameworks such as ARTEX over the next 12 months", and that the separate ARTEX activity Microsoft tracks as Storm-0940 suggests several groups are adopting it. None of the reporting links Vapor Panda to the GitHub secret-harvesting activity Microsoft described on 5 November, covered on our ARTEX agentic secret harvesting page, so the two are treated as separate.
Timeline
| Date | Event |
|---|---|
| October 2023 | BLOODALCHEMY backdoor first publicly documented. |
| 17 October 2026 | Vapor Panda's ARTEX campaign begins, according to CrowdStrike as reported by IT Brief and BleepingComputer. |
| 21 October 2026 | Zscaler ThreatLabz publishes research on a separate Chinese-speaking operator using a customised ARTEX framework. |
| 29 October 2026 | IT Brief reports CrowdStrike's findings: more than 200 organisations targeted, nine with confirmed post-exploitation. |
| 2 November 2026 | BleepingComputer reports the findings, including the forged administrator token at a Greek government body. |
| 5 November 2026 | Microsoft separately reports ARTEX use to harvest leaked secrets and abuse service principals. |
How it happened: the identity attack path
- Operator sets the goal. A human operator gave instructions in Chinese to ARTEX planning agents, which coordinated worker agents across many targets at once.
- Initial access. Agents scanned, exploited vulnerabilities and deployed web shells, and ran password spraying and credential scanning against further targets.
- Harvesting stored secrets. Agents gathered credentials from compromised systems, including LAPS passwords and, at the Greek government body, authentication keys sitting in a 2022 mail-server directory export.
- Forging privileged tokens. With those keys, BleepingComputer reports, the agents forged an administrator token, showing how stale signing or authentication material can be turned into fresh privileged access.
- Using machine and admin identities. Agents read mailboxes with the forged access, and in a US pharmaceutical intrusion used credentials from a cloud metadata exposure for a role that could command thousands of instances.
- Persistence. The BLOODALCHEMY backdoor was used against government entities in Latin America and the Middle East.
Impact
- Confirmed by CrowdStrike, as reported: post-exploitation at nine organisations, including telecom providers, government ministries and pharmaceutical firms, and mailbox access at a Greek government body.
- Targeted: more than 200 organisations in at least 14 countries, including 19 US organisations across pharmaceutical, semiconductor, defence, nuclear and financial sectors, according to IT Brief; at least 12 faced password spraying and credential scanning.
- Undisclosed: victim names, what data was taken and whether forged or stolen credentials have since been revoked.
- Wider: the reporting shows one operator running many simultaneous intrusions with agents, which raises the volume of credential attacks any single defender may face.
What this means for NHI and AI agent security
The forged administrator token is the identity story. A key from a 2022 directory export should have been rotated or destroyed long before October 2026. Instead it let agents mint administrator access and read mail. That is a familiar NHI failure: signing keys, service credentials and authentication secrets that outlive their purpose and sit in backups, exports and file shares. AI agents do not need new tricks to exploit them; they are simply quicker at finding and trying them across hundreds of targets.
The cloud metadata finding is a second, separate lesson. Workload credentials exposed through instance metadata gave the attackers a role with administrative reach over thousands of instances. Limiting what each workload role can do, and hardening metadata access, keeps one exposed host from becoming fleet-wide control. Our Cloud Workload Identity Guide, Secrets Management Guide and Agent Threats and Attacks Guide cover these controls. For comparison, see the GitBook breach, where the victim also reported an AI-assisted attacker chaining machine credentials at speed.
Recommendations
- Rotate signing and authentication keys after any suspected exposure. CrowdStrike recommends rotating signing, preauthentication and service credentials; include keys held in old exports and backups. See our Secrets Management Guide.
- Find and destroy stale key material. Search file shares, backups and directory exports for authentication keys and secrets that are no longer needed, and set retention limits on exports that contain them. See our Secret Sprawl Measurement Guide.
- Scope workload roles tightly. No instance role should be able to command thousands of instances, and metadata services should require hardened access. See our Cloud Workload Identity Guide.
- Detect forged and anomalous tokens. Alert on administrator tokens that do not match normal issuance, mailbox access by unusual principals and use of service credentials from new locations. See our ITDR Guide.
- Close coverage gaps. The operator reportedly steered agents to hosts without endpoint protection, so deploy detection and response agents broadly, as CrowdStrike advises.
- Plan for machine-speed, many-target attacks. Assume password spraying and credential scanning will arrive at higher volume, and use lockout, monitoring and automated revocation sized for that. See our Agent Threats and Attacks Guide.
Frequently asked questions
Who is Vapor Panda?
Vapor Panda is CrowdStrike's name for a China-linked threat actor that, according to IT Brief's report of CrowdStrike's research, has targeted government, think tank, energy and extractive organisations since 2021. Its October 2026 ARTEX campaign is its first observed use of AI-driven intrusion tooling and its first broad focus on pharmaceutical, semiconductor, nuclear and defence organisations.
How did AI agents forge an administrator token?
BleepingComputer reports that in an attack on a Greek government organisation, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export. The published reporting does not give further technical detail. The defensive point is that authentication keys left in old exports remain usable until they are rotated.
Is Vapor Panda behind the other ARTEX attacks?
Not according to published sources. CrowdStrike notes separate ARTEX activity tracked by Microsoft as Storm-0940, and Microsoft's 5 November report on GitHub secret harvesting does not name Vapor Panda. Zscaler's October research describes another Chinese-speaking operator. The evidence points to several actors using the same framework.
Related NHI Mgmt Group resources
ARTEX agentic secret harvesting 2026 · ConnectWise Cloud Backup breach 2026 · GitBook breach 2026 · Agent Threats and Attacks Guide · Cloud Workload Identity Guide
How NHI Mgmt Group can help
Vapor Panda's campaign shows agents finding forgotten keys and turning them into administrator access across many organisations at once. NHI Mgmt Group helps teams inventory signing keys, service credentials and workload roles, retire stale material, and build detection for forged tokens and unusual machine activity. Our training covers secrets lifecycle, workload identity and defending against AI-driven attacks. See our NHI and AI agent security training.
References
- CrowdStrike: Vapor Panda uses ARTEX to scale global campaign (29 October 2026)
- Zscaler ThreatLabz: Inside a global AI-assisted hacking campaign (21 October 2026)
- IT Brief UK: CrowdStrike uncovers China-linked AI cyber campaign (29 October 2026)
- BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs (2 November 2026)
- Microsoft Security Blog: Threat actors use agentic AI tooling to find and abuse exposed secrets (5 November 2026)