Hackers Use Autonomous AI Agents to Breach Microsoft 365 Tenants in Three Hours

Attackers linked to the Chinese state have deployed a fleet of autonomous AI agents to carry out a massive cyberattack, breaching Microsoft 365 tenants in a matter of hours. According to Microsoft's Security blog, the group, tracked as Storm-0940, weaponized an open-source agentic AI penetration testing framework called ARTEX to exploit a supply chain vulnerability involving ConnectWise. The operation, which was reported on October 23, demonstrates how AI can accelerate cyberattacks to a pace that can overwhelm human defenders.

The attack began with unauthorized access to a multi-tenant application. From there, the group leveraged stolen ConnectWise application credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants. This method allowed the attackers to authenticate as the applications themselves, bypassing the need for an interactive user sign-in. Microsoft noted that in some cases, the attackers escalated to privileged access in under three hours from the initial targeting.

As part of the campaign, the attackers also conducted a large-scale password spraying operation. This tactic involved automated password guessing against 327 accounts across eight organizations. The activity resulted in more than 151,000 failed logon attempts but no successful compromises via this method. At its peak on October 11, the password spray reached 2,900 attempts per minute, totaling over 111,000 for that day.

The use of ARTEX is a key element of the operation. Microsoft describes ARTEX as a system of LLM-driven agents that can run an autonomous penetration test. The framework's capabilities sped up scanning, reconnaissance, and password spraying. These AI agents can operate around the clock with little human interaction, working at a pace that 'leaves defenders with little time to detect and respond.' It remains unclear how the initial ConnectWise credentials were stolen or how many tenants were ultimately compromised.

Storm-0940 has been active since 2021 and is described by Microsoft as a 'China-state aligned actor.' The group targeted a range of industries, including aerospace and defense, semiconductor, government, and think tanks, among 14 sectors in total. Microsoft stressed that the campaign did not result from a compromise of its own systems, products, or services.

The attackers' activity within compromised tenants was significant. Microsoft's logs showed that more than 200 sign-ins occurred in under four minutes using four application credentials. Actions observed in some tenants included reconnaissance, directory and Graph operations, and changes to identities, groups, and privileged roles. In one instance, security firm Huntress observed an application adding itself to the top administrator role, triggering an alert for 'Application self-assigned Global Administrator role.'

The use of AI-powered hacking tools is a growing trend. Public reporting from October 2026 tied similar technology to breaches at South Korean financial institutions. In those separate attacks, CrowdStrike said the suspect was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. Meanwhile, ARTEX’s developer, known by the handle 'Autumn-27,' announced on GitHub that the project 'will no longer be updated' and will become closed source.

ConnectWise has suspended its Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management services as a precaution and has begun a phased restoration that is expected to take several days. The company stated it has no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs allow.