ARTEX goes from pentesting tool to attacker staple in three months

2026-11-09T20:51:40Z•ff12bdcd4f14e3fb93544d2c422376944658aa0e2d1fe3e8f326c420bcab29ce
CVE-2026-19868AI agentsARTEXMFA bypassOT/ICS securityPyPI provenanceSSL-VPNSonicWallactive exploitationbotnetbusiness email compromisecredential theftdeepfakesfinancial fraudinfostealersproxy abuserefrigeration controllersspamsupply-chain riskthird-party compromise

What happened

Help Net Security reports multiple cybersecurity developments, including exploitation of SonicWall SSL-VPN CVE-2026-19868 to bypass SAML-enforced MFA, compromise of internet-exposed refrigeration controllers for spam and proxy services, rapid attacker adoption of the ARTEX penetration-testing tool, deepfake-enabled business email fraud, major bank theft via a service provider, and widespread infostealer-driven credential abuse. The most urgent item is the actively exploited SonicWall authentication flaw, while the refrigeration-controller campaign and credential theft demonstrate significantห?

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
helpnetsecurity
Record identifier
ff12bdcd4f14e3fb93544d2c422376944658aa0e2d1fe3e8f326c420bcab29ce
Enrichment time
2026-11-09T20:51:40Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.