Blockchain infrastructure provider **Chainstack** disclosed on Tuesday that it fell victim to a cyberattack, resulting in unauthorized access to parts of its infrastructure. The company assesses this incident to be part of a broader, **AI-powered attack campaign** that recently came to light. "An external attacker gained unauthorized access to part of **Chainstack**'s infrastructure through a third-party component," the company stated. "We detected the intrusion, cut the access paths, and are hardening our systems." The attack timeline reveals that the threat actor initially gained access to a development environment on October 26, 2026, subsequently escalating privileges to breach "some parts of our production environment." The intrusion was detected and access was terminated on October 31, 2026. During the breach, the attacker reportedly accessed a database containing customer account information, including organization names, account holder names, email addresses of organization members, and password hashes. **Chainstack** also noted that the attacker had access to systems holding node credentials, and while there's no evidence of them being read, customers are advised to rotate them as a precaution. In response, **Chainstack** is urging customers to regenerate platform API keys, update passwords (especially where reused across services), and remain vigilant against potential phishing attempts. While **Chainstack** has not publicly attributed the attack, it's believed to align with a campaign by a China-linked group utilizing the **ARTEX** framework. ## WorkOS Also Targeted by ARTEX API platform **WorkOS** also recently disclosed a security incident involving the same autonomous AI agent framework. Discovered on October 30, 2026, this breach was confined to its Go-to-Market (GTM) systems and did not impact production environments or customer platform data. The accessed data at **WorkOS** included: * Business contact details (Names, email addresses, phone numbers, job titles, and company affiliations from their CRM system) * Business account and relationship information (Customer account histories, sales, and customer-relationship data) * Customer communications (Summaries and excerpts from sales calls, support discussions, and customer Slack conversations) * Operational metadata (Information about customer use of **WorkOS** products, including product usage and connection/directory health) This incident underscores a growing trend where AI agents are being deployed to craft bespoke attack strategies and automate various stages of an intrusion. "This increases the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials," **WorkOS** commented. "It increases the need for timely remediation and monitoring that can connect suspicious activity across systems." ## Broader Campaign Affects Multiple Entities The **ARTEX** campaign's reach extends further. Blockchain analysis firm **Chainalysis** also confirmed an intrusion into its systems and internal tools, detecting an "external actor using offensive agentic techniques." As a result, **Chainalysis** proactively took its Reactor and Data Solutions products offline as of November 2, 2026. Another victim of **ARTEX** is the **Dutch Institute for Vulnerability Disclosure (DIVD)**. A breach on September 21, 2026, involved the exploitation of two zero-day flaws (**CVE-2026-102489** and **CVE-2026-102490**) in the open-source **Zammad** ticketing system. These vulnerabilities allowed attackers to escalate privileges, execute remote code, and exfiltrate data.