On October 21, 2026, Microsoft Threat Intelligence reported that Storm-0940, a China-state-aligned actor, used ARTEX, an open-source framework of AI agents, to automate attacks against hundreds of organizations: sign-in attempts against more than 2,250 tenants at up to 2,900 attempts per minute, abuse of OAuth applications and, in some cases, privileged cloud access within about three hours. This incident drives home a simple truth: attackers now move at machine speed, so weak authentication, overprivileged applications, and slow investigation are no longer small risks. The speed and scale attackers can use will only increase.
In this article, we will dive into details about the attack, look at why AI-driven attacks change the math for defenders, and suggest a checklist our experts recommend for this week to help protect your organization against these threats.
What Microsoft found
According to Microsoft’s report, Storm-0940 has been active since 2021 and usually gets in through password spraying and internet-facing applications. In this campaign, it used ARTEX, a multi-agent penetration testing framework that can run with any AI model and automates the whole chain, from reconnaissance to data exfiltration.
Microsoft notes that most of the targeting was unsuccessful. Where it worked, the agents went beyond sign-in: they ran reconnaissance through Microsoft Graph, changed application credentials to stay in, and tried to modify privileged roles.
Why AI-driven attacks change the math
The techniques are not new. Password spraying, OAuth abuse, and privilege escalation have been in incident reports for years. What changes is speed and scale. In Microsoft’s words, “Agents are not constrained by factors affecting humans.” They do not get tired, they test thousands of combinations per minute, and they chain each step to the next without waiting.
Igor Tsyganskiy, Executive Vice President at Microsoft, put it plainly: “Since early October, a wave of AI-driven cyberattacks has been ongoing.” He described this campaign as one of many. Microsoft also reports that several threat actors from different regions are already using ARTEX.
Other security vendors see the same trend. According to Wiz, ARTEX was published on GitHub in July 2026 and was copied more than 12,000 times before its developer closed the code on October 8. The same week, CrowdStrike reported four previously unreported threat actors using AI agents in real intrusions. All four got around the safety controls of commercial AI models, and in one case an agent harvested domain controller credentials in about 20 minutes with no human guidance.
For defenders, that means three things:
- The weakest sign-in method sets the pace. If any account can still sign in with a password and SMS, or with no MFA at all, an automated spray will find it.
- Applications are identities too. Multi-tenant apps, service principals, and consent grants can give an attacker persistent access that no user password reset will remove.
- Minutes matter. When privileged access can be reached in about three hours, an alert that waits in a queue until the next morning is already too late.
The three doors attackers used
| Door | What the attacker did | What closes it |
|---|---|---|
| Weak authentication | Automated password spraying across thousands of tenants | Phishing-resistant MFA for every user, starting with administrators; no legacy authentication |
| Applications and service principals | Added credentials to existing OAuth applications and abused app permissions | An inventory of enterprise applications, least-privilege permissions, admin consent workflows, and monitoring of credential changes |
| Privileged roles | Tried to change roles and permissions through Microsoft Graph | Just-in-time privileged access, alerts on role assignments, and a tested response plan |
What to do this week
Microsoft’s report includes a detailed response guide. These are the steps our experts prioritize for any Microsoft 365 tenant, affected or not:
- Do not start by deleting applications. Preserve the evidence, disable the affected connections and investigate first.
- Review service principal sign-ins and audit logs since October 1. Look for new credentials on applications, new owners, app role assignments, consent grants, and privileged role changes.
- Find every account that can still sign in without phishing-resistant MFA. Start with administrators and accounts exposed to the internet. Our guides to the SMS and voice retirement and the 90-day passkey plan explain how.
- Restrict who can consent to applications. Use admin consent workflows and remove permissions that applications do not need. Microsoft’s app consent playbook walks through the investigation.
- Turn on and route the right detections. Microsoft lists Defender XDR and Defender for Cloud Apps alerts for this campaign, such as an application that assigns itself to the Global Administrator role. Make sure they reach someone who can act.
- Rehearse the first hour. Agree who can disable an application, revoke sessions and rotate credentials, and test it. Microsoft’s password spray playbook is a good starting point.
Defend at AI speed
Microsoft’s own answer to machine-speed attacks is an agentic security operations center. Rob Lefferts, Corporate Vice President for Microsoft Threat Protection, wrote in September that “security cannot operate at AI speed when protection and operations are built as separate systems,” and that agents bring speed and scale while people set priorities and apply judgment.
That is the model our experts help organizations put into practice: agents that watch and summarize continuously, and people who decide quickly with the right context.
How our experts help
Each door has a Synergy Advisors solution behind it:
- Weak authentication: Secure Access E-ntelligence shows, with evidence from your tenant, which users still depend on SMS, voice, or passwords, and the Secure Access Admin Agent answers the same questions in plain language, 24×7.
- Applications, agents and identities: with Agent 365 E-xperiences, our experts build an inventory of the agents and applications that act in your tenant, with an owner and least-privilege permissions for each one. Our article on agentic insiders explains why this now matters for AI agents too.
- Response at machine speed: the Micro-Vigilant SecOps Agent, one of our E-gents, shows SOC teams how Microsoft Defender XDR incidents are being handled, so critical alerts do not wait in the queue.
Frequently asked questions
Was my organization affected by Storm-0940?
Microsoft has not published a list of victims. Review the indicators and detections in Microsoft’s report, check your service principal sign-ins and audit logs since October 1, and, if you use the affected cloud backup application, follow its vendor’s guidance.
What is ARTEX?
ARTEX is an open-source penetration testing framework built as a system of AI agents. It can use any AI model to automate the steps of an attack, from reconnaissance to data exfiltration. Microsoft reports that several threat actors are using it.
Does MFA stop AI-driven password spraying?
It stops most of it. Phishing-resistant methods, such as passkeys, are the strongest option because they cannot be guessed, sprayed, or phished. Accounts with no MFA, or with legacy authentication, remain the easiest targets.
Should we delete suspicious applications right away?
No. Microsoft recommends preserving evidence first: disable the connection, investigate the sign-ins and changes, then rotate credentials and remove permissions.
Next step
Synergy Advisors experts can review your tenant against the three doors in this campaign: authentication, applications and privileged access. Talk to our experts, see the Micro-Vigilant SecOps Agent or join the Protect the Agentic Enterprise webinar on December 10.
Sources
- Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise (Oct 21, 2026) Microsoft Security Blog
- Microsoft attributes ConnectWise supply chain attack to China's Storm-0940 CyberScoop
- ARTEX in the wild: Storm-0940 expands targeting Wiz
- Agentic AI attack campaigns CrowdStrike
- App consent grant investigation Microsoft Learn
- Password spray investigation Microsoft Learn
- Reimagining the SOC for the agentic era (Rob Lefferts, Sep 23, 2026) Microsoft Security Blog
