An AI tool tried 2,250 Microsoft tenants. Some fell in under 3 hours.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On 21 October 2026 Microsoft tied the ConnectWise compromise to China-aligned Storm-0940, which used ARTEX, an open-source AI penetration testing framework, to attempt sign-ins to more than 2,250 tenants. Most attempts failed. In multiple cases, targeting to privileged access took less than 3 hours.
Why it matters
Stolen app credentials sign in with no user at the keyboard. Microsoft says the attackers kept access by adding credentials to existing OAuth applications, so fixing one app is not the finish line.
What to do
If you ever authorized the ConnectWise Cloud Backup, MS Teams or MS Graph apps, search every tenant by their app IDs and review activity from 15 October, and service principal sign-ins back to 1 October. Keep them disabled; do not delete the enterprise apps first.
My take
Lior Aharonov
Founder, 7IT Solutions
Nobody picked a lock here. A key you once handed to an app was tried on 2,250 doors.
Sources
| Microsoft Security Blog: Storm-0940, ARTEX and the ConnectWise supply chain compromise | microsoft.com |
| SecurityWeek: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.