Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.

ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.

The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.

Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.

Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.

Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.

OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.