ARTEX: AI Agents Hit 2,250 Microsoft 365 Tenants — What Changes (2026)

On October 21, 2026, Microsoft published an alert about a campaign that went viral: China-linked hackers reportedly used AI to attack at scale. True — but the important detail gets lost in the noise. The group Storm-0940 used an AI-agent framework called ARTEX to try to break into more than 2,250 Microsoft 365 environments. The AI, however, didn’t find a magic flaw: it did ordinary attacker work, very fast and at large scale. And the entry point was something every company has — a third-party integration. This post explains what happened, why MFA didn’t stop it, what actually changed, and what to do.

What happened

Microsoft Threat Intelligence attributed the campaign to Storm-0940, an actor it classifies as China-state-aligned, active since 2021 and with a history of password spraying and abuse of exposed applications. Since early September 2026, the group has used ARTEX to automate attacks against hundreds of organizations — from aerospace and defense to energy, finance, government and semiconductors.

The case that made headlines involved ConnectWise, an IT-management vendor used by thousands of companies and managed service providers (MSPs). Microsoft assesses that Storm-0940 compromised ConnectWise cloud applications and, from there, used ARTEX to attempt to authenticate to more than 2,250 Microsoft 365 tenants, at a pace of over 2,900 attempts per minute. In some cases, there were over 200 sign-ins in under 4 minutes using just 4 application credentials. ConnectWise suspended services such as Cloud Backup, SaaS Security and Cloud Management, and published advisories from October 16.

What ARTEX is

ARTEX is an open-source penetration-testing framework driven by multiple AI agents. Technically, it’s a multi-agent system written in Go with a Next.js frontend that works with any AI model. Its agents run a pentest almost autonomously — from reconnaissance to data exfiltration — and record what they find (assets, vulnerabilities) in a graph. The interface defaults to English, with Korean, Mandarin, Spanish and Japanese options.

It’s important to understand what this is not: ARTEX isn’t malware exploiting an unknown flaw. It’s an orchestrator — it takes the tasks a human attacker would do (scan, try passwords, abuse app permissions) and runs them in a loop, on its own, at machine speed. The novelty isn’t the technique; it’s the scale and cost. What used to take a team weeks, an agent does against thousands of targets in minutes.

How the attack worked

The chain has two paths worth separating, because one failed and the other is what worked:

The path that failed: password spray

Between October 10 and 14, there was a wave of password spraying (trying a few common passwords against many accounts) from a single IP, against 327 accounts at 8 organizations — more than 151,000 failed logins, peaking at 2,900 per minute. Almost all of it resulted in account lockouts, and Microsoft says no authentication succeeded in this attack. In other words: the noisy, brute-force part didn’t work.

The path that worked: stolen application credentials

The damage came from another direction. With stolen application credentialsfrom ConnectWise, the agents authenticated to customer tenants through apps that already had authorized access — with no interactive user login at all. Once inside, in some environments the agents moved into Microsoft Graph and directory operations: reconnaissance, changing the app’s credentials to maintain persistence, and changes to identities, groups and privileged roles. Microsoft even reports a ConnectWise management application self-assigning the Global Administrator role, and bulk secret reads from Key Vaults. In some cases, privileged access came in under 3 hours from first contact.

A cruel detail: because persistence was done by swapping the application’s own credentials, the attacker can keep access even after the compromised app is “fixed”.

Why MFA didn’t save the day

This is the part that matters most for decision-makers. MFA (second factor) and conditional access policies protect people’s logins. But this attack didn’t go through any person’s login: it was machine-to-machine, using an application’s identity (an application credential / service principal) that was already authorized in the environment. User MFA simply isn’t in that path.

It’s the blind spot of almost every modern company: you protected people’s logins, but you have dozens of connected applications — productivity tools, integrations, third-party SaaS — each with a machine identity and a set of permissions no one reviews. These application identities became the new back door, and MFA doesn’t cover that door.

What really changed — and what didn’t

What changed: the speed and cost of the attack collapsed. An AI agent does the tedious, repetitive work (enumerate, try, correlate, pivot) without tiring, in parallel, against thousands of targets. That changes the economics of crime: attacking en masse pays off, not just big targets. It also shortens the defense window — if privileged access arrives in 3 hours, your detection and response need to be in minutes, not days.

What didn’t change: the entry points are the same as ever. Stolen credentials, a compromised third-party app, excessive OAuth permissions, a known flaw left unpatched. The AI didn’t bring a new vulnerability — it just exploited the existing ones faster. That’s why doing the basics well is still the best defense, and the fundamentals (access management, least privilege, patching) matter more, not less.

Does this apply to me, even if I’m not China’s target?

It does — for a simple reason: every company that uses SaaS has connected apps and machine identities. You don’t have to be the final target to be the path. That’s exactly what happened here: China didn’t attack “Microsoft” directly — it attacked a vendor (ConnectWise) and, through it, reached thousands of customers. It’s the classic supply-chain attack, now with an AI agent accelerating every step. If your company integrates tools via OAuth (and nearly all do), you have the same surface.

What to do now

1. Inventory your connected applications. In Microsoft 365 / Entra, list the service principals and enterprise applications, who consented, what permissions each has and when it was last used. You’ll probably be surprised.
2. Apply least privilege. Cut broad permissions (full access to email, files, directory) an app doesn’t truly need. Review old consents.
3. Treat a vendor integration like a privileged account. Monitor “app-only” activity (no user), rotate application credentials periodically, and have a tested process to revoke a vendor’s access fast.
4. Monitor what the identity does, not who’s behind it. An alert should fire on anomalous behavior (an app sign-in followed by a permission change, a credential being created, a role self-assignment), whether it’s a person or an AI agent.
5. If you use ConnectWise: follow the official advisory, keep affected connections disabled until restoration guidance, and search your logs for the affected application IDs (not display names), reviewing activity from October 15.
6. Shorten your response. With privileged access arriving in hours, automate containment at defined thresholds (and review afterward), instead of relying on someone watching the dashboard at the right moment.

The defensive side of the same technology

The cynical take would be “AI now hacks on its own.” The useful take is different: the same technology that speeds up the attacker speeds up the defense — as long as it’s led by someone who understands what they’re looking for. In a pentest, AI is the researcher’s productivity tool (scan, correlate, generate hypotheses); the person still decides what’s a real risk, chains the flaws and proves the impact. What this attack makes clear is that testing your surface the way a real adversary would — including integrations, OAuth consents and machine identities — is no longer a luxury.

If you want to understand where your company is exposed to this kind of attack, talk to a researcher. And, more broadly, a periodic pentest finds the open doors — including the application ones — before an AI agent finds them for you.

Sources: Microsoft Threat Intelligence (official advisory), SecurityWeek, The Record and CSO Online. The attribution is Microsoft’s (“China-state-aligned actor”) and China denies involvement. The figures are Microsoft’s and may be revised as the investigation progresses.