A free, open-source AI agent helped breach some of South Korea’s largest lenders. The stolen data was the point, and what criminals do with it next is a fraud problem every credit union should plan for.

Since late September, at least nine South Korean banks have disclosed cyberattacks or been reported as targets, Reuters reported on Oct. 8. The names are not small. Shinhan Bank said the personal information of about 25,000 customers was compromised. KB Kookmin Bank said 119 customers’ data leaked.

Across at least seven financial institutions, reports put the number of people with exposed personal data at 68,000 or more, The Record reported. At Shinhan, the stolen fields included names, phone numbers, annual income and loan limits, according to The Korea Times.

The tool investigators keep pointing to is called Artex. And anyone could download it.

The attack tool was free

Artex is an open-source AI agent for automated penetration testing, published on GitHub this year by a Chinese security engineer, per Reuters. It plugs into outside large language models such as ChatGPT, Claude and DeepSeek. Its own GitHub page says it is meant for personal learning and code research, not real-world testing of online systems.

The Korea Times described what it automates: scanning for vulnerabilities and mapping potential attack paths, work that usually takes human expertise. Multiple AI agents can analyze a target and its intrusion routes at once.

South Korea’s president put the implication plainly. Signs have emerged that AI agents were used in at least some of the attacks, President Lee Jae Myung said, adding that it has become possible to use AI for hacking “with ease even without specialized skills,” The Record reported.

A software developer at one of Korea’s five largest brokerages told the Korea JoongAng Daily: “Even without the skills, anyone who pays can use attack tools.”

Experts are careful about how much credit the tool gets. “It has not been confirmed whether Artex was the only tool used in the attacks,” said Kim Seung-joo, a professor at Korea University’s Graduate School of Information Security. “Whether AI was used is not the point.”

The breach was about resale

CrowdStrike’s analysis, reported by Reuters, assessed with moderate confidence that the attacker is likely a Chinese speaker and “financially motivated.” It linked a suspect to both Artex and Anthropic’s Claude Code. A man reached at a phone number CrowdStrike provided said he had no knowledge of the matter.

The most telling detail is what the suspect asked an AI for help with. According to CrowdStrike, the suspect asked Claude where threat actors typically sell Korean data breach information and sought help finding Korean Telegram groups that trade stolen data.

That’s the business model. Break in cheaply, take names, phone numbers and financial details, and sell them on.

Why stolen data turns into fraud

For the institutions involved, the breach is the headline. For their customers, it’s the beginning. A buyer who holds a member’s name, phone number, income and credit limit has everything needed for a convincing call, text or account takeover attempt. Dongguk University professor Hwang Suk-jin warned that follow-up attacks could use information obtained in the breaches, The Korea Times reported.

Customers already feel it. One victim organizing a class-action suit over the Shinhan breach told the JoongAng Daily: “People in the same situation need to at least pool information.”

The lesson for U.S. credit unions isn’t about Korean networks. It’s that the cost of stealing member data just fell close to zero, and the people stealing it are planning to sell it. Some of that data will eventually be used against accounts that were never breached at all.

Real-time detection isn’t the same as real-time protection

Korean security experts landed on the same conclusion from different directions. “We need to move toward using AI to block AI,” said Youm Heung-youl, professor emeritus at Soonchunhyang University. Korea University’s Lim Jong-in told The Korea Times that “defenders also need to use AI to detect weaknesses first.”

They’re right, but detection alone isn’t defense. When a fraudster working from a purchased data set calls a member, gets a one-time code, and starts moving money at 11 p.m. on a Saturday, an alert sitting in a queue until Monday is a record of the loss.

The old model: Detect → Alert → Wait for a human.

The model this moment demands: Detect → Assess → Act.

Where RembrandtAi® fits

RembrandtAi® is built for the part that comes after the breach, when stolen data turns into transactions. It ingests events across every channel (card, ACH, remote deposit, online banking, ATM), scores each one in real time with multi-stage AI, including neural networks, statistical analysis and machine learning, and measures that risk against thresholds your team sets.

When a score crosses the line, RembrandtAi® acts directly in your banking core. Member alerts, card restrictions, transaction blocks, account freezes and access suspension fire automatically, 24/7/365, with no human in the loop required. It doesn’t matter whether the fraudster bought the data on Telegram or phished it last week. What matters is what’s happening in the account right now.

Humans still matter. Your team sets the thresholds, works the exceptions and owns the member relationship. RembrandtAi® makes sure nothing waits on them overnight.

The approach has a track record. Launch Credit Union adopted RembrandtAi® at the end of 2020 and saw a 97% reduction in fraudulent transactions, saving $1.8 million in 2021, American Banker reported. As CFO Kevin LeBeau put it: “If you’re uploading three hours later, that money is already gone.”

The takeaway

A free tool and an AI assistant were enough to help pull customer data out of major banks, and the suspect’s next question was where to sell it. Attackers now move at machine speed and machine cost. Fraud defense has to as well.

AI must move at the speed of payments.

See how RembrandtAi® acts in real time, in your core. Request a demo.

Sources

1. Reuters, “CrowdStrike says China-based suspect used AI tools in South Korean bank hacks,” TimesLIVE, Oct. 8, 2026. https://www.timeslive.co.za/news/sci-tech/2026-10-08-crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks/
2. Kim Jeong-jae and Lee Gyu-rim, “AI-driven hacks on banks leave customers fearing their data is fair game,” Korea JoongAng Daily, Oct. 5, 2026. https://www.koreajoongangdaily.com/korea/aidriven-hacks-on-banks-leave-customers-fearing-their-data-is-fair-game/12905416
3. Suzanne Smalley, “South Korean officials believe AI agents were used to hack several banks,” The Record from Recorded Future News, Oct. 6, 2026. https://therecord.media/south-korean-bank-hacks-ai-agents
4. Lee Hyo-jin, “[EXPLAINER] How AI emerged as new threat in Korea’s bank hacking crisis,” The Korea Times, Oct. 7, 2026. https://www.koreatimes.co.kr/business/banking-finance/20261007/explainer-how-ai-emerged-as-new-threat-in-koreas-bank-hacking-crisis
5. “Florida credit union overhauls its fraud prevention with big assist from AI,” American Banker, May 6, 2022. https://www.americanbanker.com/news/ai-revolutionized-how-this-credit-union-prevents-fraud