Cybersecurity News Today: ARTEX AI Agents Walked Into Tenants Through Trusted Apps
The lead story in cybersecurity news today is not a password attack that worked. It is an app-trust attack that did. Microsoft has attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned actor active since at least 2021. The tool at the center is ARTEX. ARTEX is a Go-based agentic AI penetration testing framework, and Microsoft says Storm-0940's operators ran it at machine speed against hundreds of organizations: reconnaissance, password spraying and OAuth application abuse, with no interactive user sign-in at the end of the chain. The audit below scores the one thing that decided this incident: how much trust your tenant hands to applications.
Honest scope, read this first: the loud part of this attack failed. Between October 10 and 14, 2026, the agents made more than 151,000 password-spray sign-in attempts, and Microsoft detected zero successful authentications in that window. The breach path was quieter. On October 15, the agents obtained the identities of multiple ConnectWise cloud applications and signed in to customer tenants with stolen app credentials, through applications those tenants already trusted. No password had to be guessed, and no user had to sign in. If you take one thing from this page: the list of applications your tenant trusts is now an attack surface, and it deserves the same review your user accounts get.
The attack, exactly as disclosed
Attribution: Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned actor active since at least 2021 and known since November 2024 for password spraying through the Quad7 botnet, also tracked as CovertNetwork-1658.
The framework: ARTEX went closed-source after its abuse in attacks on South Korean financial institutions; Recorded Future's Insikt Group tracks that cluster as TAG-217, with activity from August 17, 2026. Zscaler ThreatLabz recovered a working deployment: a DeepSeek model behind an OpenAI-compatible gateway, other configurations naming DeepSeek, GLM and Grok, prompts that had the models split investigation tasks and review each other's findings, GLM checking work by DeepSeek and its subagents, and a Claude Code prompt history left in the deployment.
Scale and speed: agent-driven attacks at machine speed since September 2026, against hundreds of organizations across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology and think tanks. In several cases, Microsoft says, the time from initial targeting to privileged cloud access was under 3 hours.
The spray: the agents attempted sign-in to more than 2,250 tenants at up to 2,900 attempts per minute. From October 10 to 14, one infrastructure address, 144.172.64[.]99, sprayed 327 accounts across eight organizations in Microsoft 365 and Exchange Online. Microsoft captured over 151,000 failed logons, peaking on October 11 with more than 111,000 failures in a single day; 48 accounts took over 1,000 failures each. No successful authentication, token issuance, Graph call or directory change was detected in that window.
The pivot: on October 15, the agents gained access to the identities of multiple ConnectWise cloud applications and used the stolen app credentials to authenticate to customer environments, riding the trust those apps already held inside each tenant. Follow-on activity went past sign-in: Microsoft Graph and directory operations, reconnaissance, changes to identities, groups and privileged roles, and application credential modifications that plant persistence.
The persistence problem: Microsoft warns that an application credential modification made by the agents can stay active as a backdoor through other identities, credentials and cloud services even after the original compromised application is remediated.
151,000+failed logons Microsoft captured during the October 10 to 14 spray, with zero successful sign-ins
2,250+tenants the agents attempted to sign in to during the ConnectWise phase
2,900sign-in attempts per minute at the peak pace Microsoft observed
Under 3 hoursfrom initial targeting to privileged cloud access in several cases Microsoft describes
Two more facts frame the incident. In the TAG-217 prompt histories, Zscaler and Recorded Future found requests for bulk personal and transaction data, questions about selling stolen data, and work on payment gateway API key extraction and NFT minting exploits, which points to a financial motive in that cluster. And ConnectWise, which temporarily shut down services and is restoring them in phases over several days, put the MSP problem plainly: MSPs are targets in their own right, and they are also a path into every client they serve. If a vendor's application sits inside your tenant with standing trust, the vendor's compromise is your incident.
Update, October 22, 2026: the same agent-credential problem now has a consumer face. Axios reported the same day that major US banks are detecting third-party AI agents inside customer accounts, logged in with credentials the customers themselves handed to agent services, and that banks cannot reliably tell the agent from the account owner. The enterprise version above is stolen app trust; the consumer version is a shared password. Our companion check walks through the personal side: Bank AI Agent Access Check.
Why this cybersecurity news today matters: the password was never the door
Defenders have spent a decade hardening the user sign-in: MFA, conditional access, impossible-travel alerts. Application sign-ins sit outside most of that. A service principal does not do MFA. Its credential works from any network the tenant accepts, at any hour, at machine speed, and a dormant vendor app can hold directory-level permissions for years without a single human looking at it. Storm-0940's operators understood the asymmetry: five days of spraying bought them nothing, and one set of stolen app identities bought them tenants. The control that matches this threat is not another password rule. It is an inventory of granted applications, with an owner, a scope you can justify, a credential that rotates, and an approval step before any new app earns trust.
Audit one granted app: the 60-second ARTEX check
Pick ONE application granted in your tenant (an enterprise app in Microsoft Entra ID, or a third-party app in Google Workspace) and answer for that app only. Everything runs in your browser; nothing is sent anywhere. Run it again for each app on your list.
Run the app-trust cleanup now
Inventory every granted application: in Microsoft Entra ID, list enterprise applications and app registrations; in Google Workspace, list third-party access. For each one record the owner, the permission scope, the last sign-in and the credential age. An app you cannot attribute to an owner goes to the top of the review pile, not the bottom.
Hunt for persistence before anything else: review application credential changes made on or after October 15, 2026. Microsoft is explicit that a credential modification planted by the agents can outlive remediation of the original compromised app, so removing the bad app without auditing credential changes leaves the backdoor in place.
Search the sign-in logs: look for 144.172.64[.]99 and for velocity anomalies. The spray peaked at 2,900 attempts per minute and 111,000 failures on October 11 alone, and it still produced zero successful sign-ins; weight service-principal sign-ins and new credential events more heavily than failed user logons in your review.
Rotate on a schedule, prefer certificates: any app credential older than 90 days gets rotated this week. Where the platform supports it, replace long-lived client secrets with certificates or workload identity federation, so there is no static secret to steal.
Cut dormant apps and fat scopes: an application that has not signed in for 90 days does not need standing trust; disable its sign-in or revoke the grant. Directory write should be rare enough to name from memory; if you cannot name them, that is the finding.
Gate new grants: turn on an admin consent workflow so no user, and no vendor onboarding flow, can grant a new application tenant trust without an approval. Standing trust handed out silently is how a vendor's incident becomes yours.
Agent Auth Gateway, Ingenious AI's authorization layer for AI agents and connected apps, is built for the control this incident argues for: every application and agent gets a scoped credential instead of a standing master key, new grants pass an approval queue, budget caps bound what an identity can spend, and a kill switch revokes a compromised app identity in one step instead of a tenant-wide scramble. See how Agent Auth Gateway works.
FROM INGENIOUS AI
Agent Auth Gateway is built for exactly this: scoped app credentials, approval queues for new grants, and a kill switch for the day a trusted app identity is stolen.
2. How did the October 10 to 14 password spray end?
3. What actually let the agents into customer tenants on October 15?
4. Why can the persistence outlive the fix for the compromised app?
5. Which profile scores highest in the app-trust audit above?
Frequently asked questions
What is ARTEX, in plain terms?
ARTEX is a Go-based agentic AI penetration testing framework: software that points AI models at networks and systems to probe them the way a human tester would, only faster and around the clock. Zscaler found a deployment wired to DeepSeek, GLM and Grok models that split tasks and reviewed each other's findings. Its abuse in real attacks pushed it closed-source.
Did the Storm-0940 password spray succeed?
No. Microsoft says the October 10 to 14 spray from 144.172.64[.]99 produced more than 151,000 failed logons across 327 accounts in eight organizations, peaking at 111,000 failures on October 11, and not one successful authentication was detected in that window. The damage came later, through stolen application identities, not guessed passwords.
How did the agents get into customer tenants on October 15?
Microsoft says the agents obtained the identities of multiple ConnectWise cloud applications and authenticated to customer environments with the stolen app credentials. The apps were already granted trust inside those tenants, so no interactive user sign-in was needed. From there the agents ran Microsoft Graph and directory operations, including reconnaissance and changes to identities, groups and privileged roles.
Why does fixing the compromised app not end the incident?
Because the agents changed application credentials inside victim tenants. Microsoft warns those modifications can stay active as a backdoor through other identities, credentials and cloud services even after the original compromised application is remediated. Closing the incident means auditing every app credential change, not just removing the first bad app.
What should my team check first in our own tenant?
Start with the granted-apps list. For each application, note the owner, the permission scope, the last sign-in activity and the credential age, then check for credential modifications made on or after October 15, 2026. Search sign-in logs for the spray address 144.172.64[.]99 and for sign-in velocity spikes. The audit above scores one app at a time.
Sources: The Hacker News, October 22, 2026 (the Storm-0940 attribution, the ARTEX framework, the spray figures, the October 15 app-identity pivot and the ConnectWise response) · Microsoft's Storm-0940 and ConnectWise Cloud Backup disclosure, as reported in that coverage (the 151,000 failed logons, the 144.172.64[.]99 spray infrastructure, the under-3-hours figure and the credential-modification persistence warning) · Zscaler ThreatLabz's analysis of the recovered ARTEX deployment (the DeepSeek, GLM and Grok configurations, the cross-review prompts and the Claude Code prompt history) · Recorded Future Insikt Group's TAG-217 tracking (activity from August 17, 2026 against South Korean financial institutions).
Related checks
Google Workspace MCP OAuth Deadline Check: from November 11, 2026, Workspace MCP servers reject OAuth clients not marked as agentic, and the flag locks on November 12