China-linked group used agentic AI in supply-chain attacks

Agentic AI framework deployed in supply-chain compromise

China-aligned threat actor Storm-0940 used ARTEX, an open-source agentic penetration-testing framework, to conduct automated attacks targeting hundreds of organizations globally, including a ConnectWise supply-chain compromise, according to Microsoft's threat intelligence division. The campaign, documented between September and October 2026, demonstrates how autonomous agent frameworks designed for legitimate security testing can be weaponized to scale offensive operations across multiple targets and infrastructure layers.

ARTEX is capable of automating the entire attack lifecycle—from reconnaissance through data exfiltration—and can integrate any AI model to execute tasks including password spraying, OAuth-application abuse, and account compromise, Microsoft reported. The framework's flexibility to work with arbitrary AI models makes it particularly dangerous: threat actors can swap underlying language models or reasoning engines without rewriting core attack logic.

Documented password-spraying and tenant-targeting campaigns

Between October 10 and October 14, 2026, Storm-0940 infrastructure conducted an automated cross-tenant password-spraying campaign targeting 327 accounts across eight organizations to obtain access to Microsoft 365 and Exchange Online, Microsoft said. Following the ConnectWise compromise, the group escalated operations significantly: Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants at a rate of approximately 2,900 sign-in attempts per minute, demonstrating how agentic automation can overcome traditional rate-limiting and detection mechanisms designed for human-speed attacks.

The use of an open-source framework underscores a growing pattern in the agent economy: tools designed for defensive or legitimate development purposes are being repurposed at scale by sophisticated threat actors. ARTEX's public availability means defenders must assume the framework is now actively used in operations, and organizations running Microsoft 365 and Exchange Online should expect continued targeting using similar agentic techniques.

Implications for agent security and supply-chain risk

The Storm-0940 campaign represents a significant inflection point: agentic frameworks have moved from theoretical threat to documented real-world weapon. Unlike traditional malware or scripted attacks, ARTEX-powered campaigns can adapt, parallelize across thousands of targets, and make decisions about which attack paths to pursue—all without manual operator intervention. The speed and scale of the Microsoft 365 tenant-targeting campaign (2,900 attempts per minute) would be logistically impossible for human operators.

Defenders and policymakers should treat open-source agentic frameworks with the same scrutiny applied to other dual-use security tools. Organizations should audit their authentication logs for high-volume failed sign-in attempts, implement robust multi-factor authentication, and monitor for anomalous API usage patterns that could indicate ARTEX-style reconnaissance activity.