AI agent attack hit 2,250 Microsoft 365 tenants: audit your OAuth apps

An AI agent framework just ran a real attack against Microsoft 365 at scale. Microsoft Threat Intelligence says a China state-aligned actor it tracks as Storm-0940 used ARTEX, an open-source agentic AI penetration-testing tool, to reach more than 2,250 tenants through compromised ConnectWise applications. In several cases, the time from first targeting to privileged cloud access was under three hours. If your IT provider connected anything to your Microsoft 365 tenant, this one is about you.

What actually happened

The details come from Microsoft's October 21 security blog post:

• The entry point: ConnectWise publicly reported unauthorized access to customer tenants through multiple OAuth application identities on October 16. Microsoft assesses that Storm-0940 was behind it.
• The tool: ARTEX is a multi-agent LLM system that can run a test from reconnaissance to data exfiltration and works with any AI model.
• The pace: Microsoft says the actor reached 2,250+ tenants at up to 2,900 sign-in attempts per minute. A separate password-spray run from October 10–14 logged more than 151,000 failed logons.
• The outcome: Most targeting failed, but Microsoft says the actor got privileged cloud persistence at many organizations. Microsoft also says the activity was not caused by a flaw in its own systems.

Why the Microsoft 365 OAuth attack matters for your business

Your vendors' apps hold keys to your tenant. The attackers did not guess your password. They used app credentials that a trusted vendor's software already had. Every backup tool, RMM agent, and "connect to Microsoft 365" button you have clicked is a standing permission, and most small teams never look at that list again.

AI shrinks the defender's window. Three hours from first touch to admin access is faster than most small businesses check an alert. Agent frameworks make that speed cheap. Your controls have to work without a person watching.

Don't panic-delete. Microsoft says to preserve Entra sign-in and audit logs first, and to search by application ID, not display name. Deleting the app before you capture evidence destroys the record of what it did.

Sources: Microsoft Threat Intelligence: Storm-0940 uses ARTEX.