AI agents used in South Korean bank breach campaign

CrowdStrike identified a campaign targeting at least nine South Korean banks from late September to early October 2026, with attackers deploying AI agent tools including the Chinese-developed ARTEX and Anthropic's Claude Code Reuters.

Scale of Exposure

Shinhan Bank disclosed approximately 25,000 customers' personal information had been compromised through unauthorized access to a loan-agent service used to check application status Reuters. KB Kookmin Bank reported a separate intrusion affecting 119 customers after an external breach of a mobile system used by bank employees Reuters.

The campaign represents one of the first documented real-world cases of AI agents being weaponized in financial institution breaches at scale, surfacing as financial regulators globally grapple with the security implications of agentic systems deployed in banking workflows.

Attack Method and Attribution

CrowdStrike described the activity as a human adversary using AI agents to automate reconnaissance and compromise procedures. The attacker reportedly used ARTEX—a Chinese-developed tool—alongside large-language-model capabilities from Claude to navigate authentication systems and exfiltrate data Reuters.

Reuters reported that a suspected individual potentially based in China's Guangdong province was linked to the campaign, citing sources familiar with the investigation. South Korean police launched a formal investigation in the week of October 8, 2026.

Verification Gap

While CrowdStrike attributed activity to the suspected actor and identified at least nine targeted South Korean banks through public disclosures and local media reporting, the available sources do not establish that all nine incidents were conclusively attributed to the same actor or that CrowdStrike publicly named the complete list of institutions.

No criminal charges, court proceedings, sentences, regulatory enforcement actions, or quantified financial losses have been reported as of October 2026. The incidents remain under active investigation by South Korean authorities.