ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
Storm-0940 uses ARTEX AI agent to target identity providers and IT vendors in October 2026.
Wiz Research identified a Chinese state-aligned actor (Storm-0940) using ARTEX, an autonomous AI penetration-testing agent, to attack multiple IT and software vendors including Okta, Entra, and Cognito throughout October 2026. The attacker employed a repeatable playbook involving reconnaissance of applications, probing authentication mechanisms, password spraying, account recovery abuse, and tenant isolation testing. The activity overlaps with Microsoft's recent reporting on Storm-0940 and represents an expansion of supply-chain compromise attempts across the software sector.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ARTEX
- mitre_attack — T1592
- mitre_attack — T1110
- mitre_attack — T1078
- mitre_attack — T1550