Amazon Threat Intelligence: MadPot Decoys Posing as LLM Inference APIs Captured ARTEX Attack Agents' Own Campaign Memory, Revealing Self-Funding AI Key Theft and Deepfake KYC Attempts on Crypto Exchanges (Every Deepfake Was Rejected)
In an AWS Security Blog post on November 13, Amazon CISO CJ Moses wrote that from October 3 to November 5, 2026, Amazon's global decoy sensor network MadPot, configured to present as popular LLM chat-completions interfaces, received requests from attack agents running on ARTEX, an open-source agentic penetration testing framework. Because agent frameworks send their system prompts, tool histories and knowledge-graph state to the "model", single requests often carried a campaign's full record. Amazon assesses with moderate confidence that the activity came from disparate Chinese-nexus groups. The largest campaign stole AI model credentials at scale, with stolen keys paying for the inference behind further key hunting; another tried to beat KYC checks at two crypto exchanges with real-time deepfake video and forged ID photos, but the vendor's server-side verdict rejected every recorded deepfake attempt. Amazon stresses that none of the techniques were new and that it cannot verify the outcomes the agents reported.
Key Takeaways
- Observation window October 3 to November 5, 2026: MadPot sensors emulated popular LLM chat-completions interfaces on various ports, ARTEX agents treated them as model backends, and requests carried system prompts, tool histories, knowledge-graph state and reported findings (AWS Security Blog)
- Campaign 1, industrial-scale AI credential theft: targets included LLM gateways such as One API, New API, Veloera, Sub2API and LiteLLM, plus apps such as Dify, FastGPT, Langflow, RAGFlow, Open WebUI, LobeChat and Ollama, via unclaimed installs, anonymous admin endpoints, the LiteLLM default master key, CVE-2025-3248 (Langflow) and CVE-2026-28797 (RAGFlow)
- Keys were graded L1 (lead), L2 (confirmed working call) and L3 (quantified impact); keys public for more than 30 days were treated as low-value inventory, and stolen keys were fed into the framework's own model gateway to power more hunting
- Campaign 2, deepfake KYC bypass at two crypto exchanges: the best attempt finished the liveness movement sequence within 7 pixels of the target, yet the vendor's server-side verdict rejected every recorded attempt; a separate session built a real-time face-animation pipeline on one consumer GPU at 11.5 fps, with at least four agent sessions working in parallel
- Attribution is moderate confidence (prompt references to ARTEX tooling, simplified Chinese prompts, China time-zone settings); Amazon did not observe the activity live, cannot verify the agents' reported outcomes, notified potentially affected AWS customers, and published 11 IOC IP addresses
