ARTEX campaign exposed over 190,000 game credentials; active accounts remain an estimate

An ARTEX campaign investigated gray-market game services and used application reversing plus exposed administrative credentials to reach publicly readable game account token material.

Check Point recovered more than 190,000 records. Only 29 samples were validated and a roughly 6,000 active-account figure is an extrapolation, not independently verified accounts or a proven resale volume.

The exposed game material was not a single password database extracted through one generic prompt. Check Point describes an ARTEX investigation of multiple gray-market Honor of Kings services, involving mobile application analysis, exposed administrative access and a readable credential file. The researchers recovered more than 190,000 credential-like records, but only 29 sample login sets were tested; the approximately 6,000 active-account estimate extrapolates from that sample. Records, valid tokens and distinct current users are different denominators. There is no disclosed evidence of subsequent account resale or use by the researchers. This campaign should remain distinct from the iOS signing and cryptocurrency-payment campaigns even though the tooling overlaps.

A file containing more than 190,000 account records establishes substantial exposure, but a small sampled login check cannot turn the entire file into 190,000 active victims. The approximate 6,000 figure is an extrapolation and should not be presented as a count of verified takeovers or sales. The ARTEX framework's involvement belongs to the observed reconnaissance and collection chain; it does not establish who later used any token. Defensive follow-up requires revocation and notification without attempting fresh authentication against affected users.