ARTEX operators steal iOS signing credentials and tamper with an app delivery bucket
Check Point reports ARTEX-driven theft from ten iOS signing shops, taking over 300 certificates/passwords, with three passing signing validation. A separate operation rewrote a crypto app delivery manifest after an API leaked AWS credentials, but no successful crypto theft was observed. These are distinct campaigns, not proof of an Apple platform breach.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Operators of signing shops, application delivery buckets and credential stores exposed through vulnerable APIs or weak access controls
- ARTEX · supply chain · code signing
- In the wild
- Yes
- Check Point inspected exposed operator databases and reports executed compromises.
What happened
Check Point reports more than 300 certificates and passwords taken from signing shops; three passed its described usability checks. This compromises signing material, not Apple’s signing infrastructure. These research counts are not independently verified; affected organizations and final revocation status are undisclosed.
In a separate crypto operation, leaked AWS credentials enabled an app-distribution bucket rewrite; the owner later restored the manifest. The reported wallet stayed empty. Another operation extracted gaming credentials; its validity estimate came from sampling, not a confirmed count of newly compromised users.
L4 reflects observed credential theft and supply-chain modification. No shared actor is established with WorkOS or other ARTEX-linked incidents merely because the same tool appears.
Crime-scene timeline
Oct 14–29, 2026
Two consoles target ten signing shops
Check Point dates the certificate-theft operation to this period.
Nov 5, 2026
Check Point publishes operator-side research
The signing theft and separate S3 manifest modification are observed compromises; attempted wallet drains do not establish stolen funds.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Check Point Research original console investigationPrimaryNovember 5 report; campaign evidence, validation limits, delivery tampering and full infrastructure table.
- Check Point accompanying research summaryPrimarySame research origin, not independent corroboration; confirms certificate validation and separate campaign boundaries.