Update: WorkOS Says an Attacker Used ARTEX AI to Breach Its Sales App

Another ARTEX case, following my ARTEX update and the original Vapor Panda post.

What happened

• On Oct 30 WorkOS found unauthorized access to an internal app its sales team uses
• Taken: CRM contact details, account histories, summaries and excerpts of sales calls and support chats, and relationship info. WorkOS says no app data or production services were touched
• Founder Michael Grinich says the attacker used ARTEX, seen in user agents like artex-enrich/1.0 and norma/0.4
• ARTEX went private after attacks on South Korean banks, but forks are still out there
• WorkOS says it’s contained, has an outside forensics firm, and will notify affected customers

My take

Garlic because the investigation isn’t done. WorkOS serves thousands of companies, so expect phishing that uses real sales-call details. And those user agents are worth adding to your log alerts.

God Bless, and Needs Garlic!

References & Further Reading

• WorkOS says attacker used ARTEX AI to breach internal sales app (BleepingComputer)
• Update: More on ARTEX (EtherNinja)
• China’s Vapor Panda Pointed an AI Agent Framework at 200+ Organizations (EtherNinja)