Storm-0940 uses ARTEX AI agent to widen attacks on IT vendors
Wiz reports that throughout October 2026 an actor used tooling associated with ARTEX, an open-source autonomous penetration-testing agent, to target IT and software vendors. Activity focused on identity providers (Okta, Entra, Cognito) and Microsoft 365 integrations, including reconnaissance of application source maps and APIs, OAuth and JWT manipulation, password spraying, and account-recovery abuse. Wiz says the activity overlaps with Microsoft's report on Storm-0940, a Chinese-state aligned actor.
Open original source www.wiz.ioOne primary source; other links are context, not independent corroboration.
- Primary sourceX discovery · automated brief
- Discovery linkX
- Linked in sourcerecent report on Storm-0940
- Linked in sourcesupply-chain attack involving stolen vendor credentials and downstream Microsoft 365 tenants
- Linked in sourceattacks on South Korean banks
- Linked in sourceattacks on Japanese companies in October
- Linked in sourceZscaler
- Linked in sourcemade the tool closed-source on October 8
- Linked in sourceWiz Agentless Workload Detection
- Linked in sourceAI Threat Readiness Framework
- Linked in sourceWiz's AI Red Agent
- Linked in sourceARTEX: Agentic AI Campaign Enables Cloud and Supply Chain Compromise
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
- Linked article+30
- Fetched source page+30
- No editor link review0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
Wiz reports that throughout October 2026 an actor used tooling associated with ARTEX, an open-source autonomous penetration-testing agent, to target IT and software vendors. Activity focused on identity providers (Okta, Entra, Cognito) and Microsoft 365 integrations, including reconnaissance of application source maps and APIs, OAuth and JWT manipulation, password spraying, and account-recovery abuse. Wiz says the activity overlaps with Microsoft's report on Storm-0940, a Chinese-state aligned actor.
Key findings from the stored brief
- The actor used ARTEX-associated tooling to target multiple IT and software vendors, focusing on identity providers and Microsoft 365 integrations.
- Observed steps included downloading JavaScript source maps and Swagger documentation, then calling internal API routes named in them.
- Password spraying bursts used unique user agents and roughly one-second gaps, with a focus on software engineer accounts.
- Wiz describes the agent as adapting automatically, such as switching endpoints when rate-limited and rotating IPs when blocked.
Source claims not independently checked; attribution to Storm-0940 rests on overlap described by Wiz and Microsoft's report, which was not reviewed here.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
Wiz Research (Oct 22) says the China-aligned actor Microsoft reported on Oct 21 is now using ARTEX, an autonomous pentest agent, against more software vendors. The agent probed Okta, Entra and Cognito logins about once a second and switched endpoints when rate-limited. Wiz says most attempts failed. Microsoft blog: microsoft.com/en-us/security/blog/2026/10/21.
Source claims not independently checked; attribution to Storm-0940 rests on overlap described by Wiz and Microsoft's report, which was not reviewed here.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The post describes an AI agent chaining reconnaissance, authentication probing, and account abuse with little human direction. This suggests autonomous tooling may lower the effort needed for supply-chain-style attacks on identity systems.
Limits and open questions
Source claims not independently checked; attribution to Storm-0940 rests on overlap described by Wiz and Microsoft's report, which was not reviewed here.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.