Developer infrastructure company WorkOS said that on October 30 it identified unauthorized access to an internal application used by its sales team. According to BleepingComputer, the attacker accessed business contact records and summaries of customer communications, but the company says no app data or production services were affected. Founder Michael Grinich said the attacker used the ARTEX AI penetration testing suite to automate reconnaissance and exploitation. WorkOS provides authentication and SSO to more than 3,000 companies, including OpenAI, Anthropic and Cursor.
Blockchain infrastructure provider Chainstack said on Tuesday that an external attacker got into part of its infrastructure through a third-party component. According to The Hacker News, the attacker entered a development environment on October 26, escalated into parts of production, and was detected and cut off on October 31. The attacker accessed a database with organization names, account holder names, email addresses and password hashes. The incident is assessed to overlap with a campaign by a China-linked cluster using ARTEX.
ARTEX AI was released this year as an open-source project by Chinese developers and went private after it was used against South Korean banks; several forks of the code are still available. Chainalysis also reported last week an attacker using "offensive agentic techniques" and took its Reactor and Data Solutions products offline. Chainstack advises customers to rotate node credentials, regenerate API keys, change passwords, including on other services where the same password was reused, and watch for phishing.
