---
title: "China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants"
type: signal
url: https://frontiernewswire.com/s/china-linked-hackers-used-agentic-ai-in-attack-on-2-250-microsoft-365-801bce02
published: 2026-10-22T11:47:38.000Z
byline: "Source: CSO Online"
---

# China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

Source: CSO Online · Published 2026-10-22 · Canonical: https://frontiernewswire.com/s/china-linked-hackers-used-agentic-ai-in-attack-on-2-250-microsoft-365-801bce02

A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations. In some cases, the group gained privileged cloud access less than three hours after first targeting a victim. Microsoft said the activity did not result from a compromise of or vulnerability in its own systems, products, or services. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said in a blog post. Machine-speed sign-ins Following the breach at ConnectWise, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 att

## Sources

- [Read the original at CSO Online](https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html)

## Related

- [OpenClaw openclaw 2026.10.6 is available](https://frontiernewswire.com/s/openclaw-openclaw-2026-10-6-is-available-851a801e)
- [Enact, which develops full-stack tech for general-purpose robots, emerges from stealth with a $30M pre-seed from Mistral CEO Arthur Mensch, Yann LeCun, and more (John Reynolds/Tech.eu)](https://frontiernewswire.com/s/enact-which-develops-full-stack-tech-for-general-purpose-robots-b2a36495)
- [Gemini Omni Flash vs Veo 3.1: Which Google Video Model Is Better? \| Luma](https://frontiernewswire.com/s/gemini-omni-flash-vs-veo-3-1-which-google-video-model-is-better-luma-d72af8aa)
- [Israeli security company Lava finds 32 Nvidia Blackwell Ultra B300 chips connected to systems linked to state-owned operator China Telecom, despite US controls (Qianer Liu/The Information)](https://frontiernewswire.com/s/israeli-security-company-lava-finds-32-nvidia-blackwell-ultra-b300-26c44ef2)
- [Seedance 2.5 vs Wan 3.0: Which Is Better for Long-Form AI Video? \| Luma](https://frontiernewswire.com/s/seedance-2-5-vs-wan-3-0-which-is-better-for-long-form-ai-video-luma-818b34ea)

---

[More Latest Signal](https://frontiernewswire.com/) · [Signals](https://frontiernewswire.com/verified-reporting)