Chinese AI Tool Artex Tied to Cyberattacks on 80 Japanese Companies

Chinese AI Tool Behind Wave of Japanese Corporate Breaches

GMO Cybersecurity by Ierae has confirmed that Artex, a Chinese AI tool, was directly involved in cyberattacks on approximately 80 Japanese companies1

1

. The discovery, announced by cybercrime prevention specialist Daiki Fukumori, came after investigators detected Artex use in forensic logs during their analysis of security breaches3

3

. The attacks targeted diverse sectors including restaurant chains, car hire operators, finance, e-commerce and logistics, potentially impacting millions of customers2

2

. What makes this incident particularly concerning is that the attacks were "almost exclusively targeting Japan," according to Fukumori's blog post4

4

.

AI-Powered Security Testing Tool Weaponized for Malicious Use

Artex was originally designed as an AI-powered security testing tool to help organizations identify vulnerabilities and strengthen their cyber defenses2

2

. Developed by Chinese cybersecurity engineer Li Puhua and released as open-source software in July, the tool draws on external AI models from Anthropic, OpenAI and DeepSeek to find vulnerabilities and plan attacks with minimal human input1

1

. This dual-use nature of AI highlights a growing concern: tools meant for defensive purposes can be rapidly repurposed for AI-enabled cybercrime. The misuse of AI tool capabilities demonstrates how AI-driven cyber threats are evolving faster than traditional security measures can adapt.

Pattern Mirrors South Korean Financial Breaches

The cyberattacks on Japanese companies show striking similarities to incidents at South Korean financial firms documented by CrowdStrike earlier this month3

3

. In South Korea, Artex was used to breach at least seven South Korean financial firms, exposing personal data belonging to 68,000 people1

1

. The National Police Agency opened an investigation into these attacks, which prompted Li Puhua to revise the tool's usage terms to explicitly bar unauthorized access, data theft and other malicious activities. Despite these revisions, the damage was already done, as hackers had already reworked the tool for their own purposes.

Developer Response and Continued Threat

After acknowledging misuse by "bad actors," Li Puhua removed Artex from the code-hosting platform where it was stored and stopped programmers from accessing its source code2

2

. A statement from the developer emphasized that using Artex for cyberattacks was "entirely contrary to" his intentions, and announced that the project would no longer be updated4

4

. However, cybersecurity experts warn that illicit copies continue to circulate on the internet and might fuel additional security breaches1

1

. This reality underscores the challenge of controlling open-source software once it enters the wild.

Government Response and Industry-Wide Alert

Minoru Kihara, Japan's top government spokesman, confirmed that officials have held discussions with several affected companies and are "considering all possibilities, including the potential involvement of foreign actors"1

1

. GMO Cybersecurity discovered six internet servers launching AI-powered attacks, each broadly categorized by targeted industries, though the company has not disclosed server locations or operators4

4

. The subsidiary shared this information with law enforcement agencies to prevent further damage. The head of Japan's ruling-party cybersecurity committee declared that emerging threats had reached a "state of emergency," calling on companies to strengthen their cyber defenses immediately2

2

.

Implications for Global Cybersecurity

Cybersecurity experts emphasize that AI tools of this kind enable attackers to work faster and at lower cost than traditional hacking techniques allow1

1

. The vulnerability identification capabilities that make these tools valuable for defense also make them dangerous in the wrong hands. As AI's ability to find previously unknown ways to hack into computer systems gains global attention with the release of ever-more advanced models, organizations worldwide must reassess their security posture. The Artex incident serves as a stark reminder that the dual-use nature of AI creates new challenges for regulators, developers and security professionals who must balance innovation with protection against misuse.