Microsoft says Chinese hacking group attacked over 100 organisations using agentic AI, here is how

HIGHLIGHTS

Microsoft claims China-linked hacking group Storm-0940 used the ARTEX AI framework to target more than 100 organisations worldwide.

The campaign reportedly involved supply-chain attacks, OAuth abuse and password spraying, with some attempts gaining access in under three hours.

Microsoft recommends disabling affected ConnectWise connections, reviewing Microsoft 365 and Entra audit logs, and checking for unauthorised configuration changes.

Windows maker Microsoft, in a recent blog post, claimed a Chinese-based hacker group, ‘Storm-0940’, used artificial intelligence to target over 100 companies across the world. ARTEX, an AI testing framework, was deployed to carry out these attacks and gain access to the cloud database of the affected organisations. The turnaround time to gain access in a few cases was under three hours. Microsoft said the actor used supply chain attacks to target ConnectWise, an IT services company specialising in Cloud services for these companies.

According to Microsoft, ARTEX compromised the user sign-in page that is used to authenticate Microsoft 365 customers. The changes could include modifying app credentials, escalating privileges, unusual sign-ins and more. For the unaware, the China-state aligned actor has been active since 2021 and targets data theft from companies. The affected industries from this attack include aerospace, defence, chemicals, energy, government, legal, media, semiconductor, technology and more.

Also Read: Millions of websites at risk? OpenAI’s GPT 5.6 Sol finds critical security flaws in PHP, here is all you need to know

In the case of ConnectWise, ARTEX was used to boost scanning, OAuth abuse and password spraying. “Storm-0940’s activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organisations,” Microsoft said. However, in the majority of cases, the targeting was not successful.

ConnectWise issued an advisory in this regard earlier on October 16, 2026. ARTEX made 2,900 sign-in attempts/minute and affected 327 accounts across eight organisations. Microsoft recommended a host of mitigation measures to reduce the impact.

ARTEX threat: What Microsoft recommends

Microsoft recommends that organisations disable ConnectWise connections until the issue is fixed. Before deleting enterprise apps, users should preserve configuration to track any changes. Plus, reviewing the Microsoft 365 tenant where the affected applications were authorised is recommended. Microsoft also recommends reviewing Microsoft 365 and Entra audit records for any changes.

Also Read: PHP security alert: Why CERT-In, FBI, Google and OpenAI are warning users and how to fix it

The use of AI in such sophisticated attacks marks one of the evolving downsides of evolving technology. Activities include gaining administrative access, changing key configurations such as account information and passwords and stealing data.

Vikas Yadav

Vikas, a Copy Editor at Digit, writes to express his interest in technology. He covers consumer-centric tech news while hunting the day's most "VFM" smartphone deal. Plus, this curious geek enjoys digging into the last-mile intricacies of latest gadgets. Before Digit, he reported for Jagran English. Off work, you'll find him emotionally attached to historical sites or lost in tales of India's past. Simply put, tech is his 9-to-5, the rest is history.