ARTEX agent operation reached writable iOS distribution pages through exposed S3 keys

An ARTEX operation found a publicly reachable application API that disclosed Amazon S3 access keys and then exercised write authority over a bucket supporting enterprise iOS installation pages.

Check Point verified access to objects underlying 714 landing pages and reported that the original manifest was restored. This demonstrates distribution tampering capability, not confirmed malicious app installs or client infection.

A separate ARTEX path reached software distribution authority without proving downstream device compromise. Check Point traces an unauthenticated API that disclosed AWS credentials with write access to an S3 bucket serving enterprise iOS installation pages. The affected distribution surface included 714 landing pages and their install metadata. Controlling such objects could change which application a visitor receives, but the published investigation verifies S3 access and reports manifest restoration, not actual delivery of a hostile IPA or a malicious installation. Bucket version history and CDN receipts would determine whether a changed object reached real clients. Certificate acquisition in another ARTEX campaign should not be used to infer that this bucket delivered signed malware.

The verified result is write authority over the storage objects supporting 714 installation pages, not 714 infected users. An edited manifest could change which application a device downloads, but proving that effect would require object-version history, delivered manifest bytes and client-download evidence. The ARTEX certificate-theft investigation separately recovered a small number of usable signing identities. Their coexistence in one research publication does not prove that the same operator joined the two capabilities into a working malware-distribution operation.