China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

Storm-0940, a China-state-aligned threat actor, compromised a ConnectWise cloud backup application to target over 2,250 Microsoft 365 tenants. Using the open-source agentic AI framework ARTEX since September 2026, the group automated attacks to gain privileged cloud access in some cases within three hours. Microsoft Threat Intelligence clarified that this activity did not stem from vulnerabilities in its own systems, products, or services, but rather from the exploitation of stolen credentials via the third-party application.