Hackers spent under $1,500 on AI to raid Apple app-signing shops. The break-ins needed no new tricks

A criminal operator spent an estimated $700 to $1,500 on AI to raid shops that sell Apple app-signing certificates, according to a report Check Point Research published on Thursday. Over about two weeks, from October 14 to 29, the operator's AI agents worked mostly unattended against 10 such shops. They came back with more than 300 certificates and their passwords.

A separate campaign in the same report ran about five days for an estimated $180 to $360 in AI costs. It recovered more than 190,000 sets of login details for Honor of Kings, which Check Point calls the world's highest-earning mobile game. Check Point's sampling suggests about 3.3%, or roughly 6,000 accounts, still worked.

The lesson for executives is about price. By Check Point's cost estimates, these campaigns each ran on roughly $100 a day or less in AI fees while hitting many targets at once. Skill is no longer the barrier. Check Point's summary: attackers set the goal, while increasingly autonomous AI agents "do much of the work."

Check Point could see this because 10 attacker servers were badly configured and exposed their full databases, including the operators' instructions, model choices and every agent action. The servers ran ARTEX, a Chinese open-source AI hacking tool built for authorized security testing. Its developer made the project closed-source on October 8 after it turned up in attacks on South Korean banks, but copies made earlier still circulate. Check Point counted 1,608 live, publicly reachable ARTEX control panels.

What a stolen signing certificate buys

Apple requires iPhone apps to carry a digital signature, which normally means passing through its App Store. Signing certificates let holders install apps outside the store. Gray-market shops resell that ability. Check Point says buyers use it to modify apps, get around restrictions, or slip in data-stealing code and malware.

The market is large. A USENIX Security 2026 study, cited by GBHackers, counted 3,359 active signing sites, with resale margins of up to 3,000%.

The yield, though, was thin. Only three of the 300-plus certificates passed all of the agents' own checks: a working password, a matching key, not revoked by Apple, not expired, and a matching distribution profile. Those three could sign any iPhone app and be resold.

A closer call came in a different, failed campaign. An agent found an unprotected web interface leaking cloud storage passwords. They gave write access to a storage bucket serving 714 download pages for company-signed iPhone apps. Acting on its own reasoning under a broad goal to find and compromise a target's crypto wallet, rather than a specific instruction, the agent altered the file that directs installs. That set up the worst case: a tampered app pushed to everyone who downloads it. The owners restored the original, and Check Point found no evidence the attacker profited.

Cheap attacks through basic failures

None of the break-ins needed new hacking techniques. The agents got in through admin passwords left in website code, web interfaces that required no login, weak admin passwords and flaws that let outsiders run commands on servers. Cyber Security News put it bluntly: the risk comes from scale, not clever tricks.

Most operators used Chinese AI models, led by DeepSeek's low-cost Flash family. Only Anthropic's Opus 5.5 set off safety guardrails, Check Point says, and that operator simply switched to a more permissive Chinese model. One vendor's safeguards did little to raise the attacker's costs when cheaper, looser options were easy to swap in.

The report has limits. The victims were gray-market operators, not mainstream companies, and none of the coverage includes a response from Apple. The cost figures are Check Point's estimates from DeepSeek list prices. Its own count of exposed ARTEX servers also varies within the report.

The agents also failed in revealing ways. In the crypto campaign, they went after 292 websites in a first wave and generated 400,791 agent messages, yet stole nothing. Some reported cash-outs that never happened because a system replied "success." Unsupervised agents can finish tasks while misreading whether the real goal was met.

Mainstream companies are in range, too. In a separate report the same day, Microsoft said attackers were using ARTEX and similar tools to search public code on GitHub for exposed passwords and keys. Cybersecurity Dive reports that starting October 28, Microsoft saw stolen but still-valid credentials used to sign in to companies' cloud accounts. In one case, attackers took data from Azure Key Vaults, Microsoft's digital safes for keys.

What companies should do

The fixes are mostly basic security discipline, not new products. Security researchers covering the report recommend removing passwords from website code, requiring a login on every web interface, never storing secrets in plain text on web servers and tightly limiting who can write to cloud storage.

Treat any password or key that has appeared in public as stolen, even before abuse is confirmed. GitGuardian notes that deleting the file does not help: an exposed credential works until someone revokes or replaces it. Its own data shows 64% of valid secrets leaked in 2022 were still active four years later.

Companies that ship iPhone apps should revoke any signing certificate ever shared with a third-party signing service. They should protect Apple developer accounts with hardware-backed two-step login and watch for unexpected certificate requests.

And plan for volume. Check Point warns organizations to expect greater automated pressure on anything exposed to the internet. The board-level question is simple: if probing every one of our public systems costs an attacker under $100 a day, how long would our known weak spots last?