Report Microsoft 365 AI Agent Attack Targeted More Than 2,250 Cloud Tenants
A Microsoft 365 AI agent credential attack targeted more than 2,250 cloud tenants in October 2026. Attackers used stolen application credentials and AI-assisted tools to attempt access to business environments without requiring users to sign in again.
By Vidyadhar. Published . 7 minute read.
The short version
Attackers targeted more than 2,250 Microsoft 365 tenants using compromised application identities and the ARTEX AI framework.
An earlier password-spraying campaign targeted 327 accounts at eight organisations and generated more than 151,000 failed sign-in attempts.
Some AI-assisted attacks reached privileged cloud access in less than three hours, although the total number of successfully compromised tenants remains unconfirmed.
Key findings
A cybersecurity campaign reported in October 2026 showed how attackers could combine stolen application credentials with AI-assisted tools to target Microsoft 365 environments. The incident highlighted weaknesses in third-party application access and cloud identity management.
More than 2,250 Microsoft 365 tenants were targeted. Attackers attempted to access cloud environments using compromised application identities and ARTEX.
327 accounts were targeted across eight organisations. An earlier password-spraying phase generated more than 151,000 failed sign-in attempts.
Some attacks reached privileged access in under three hours. Automated activity helped attackers progress rapidly through certain cloud environments.
The campaign was reported in October 2026. Investigators linked the activity to compromised third-party application credentials and a threat group tracked as Storm-0940.
Microsoft 365 AI agent credential attack explained
The attack involved credentials belonging to trusted cloud applications. Instead of relying entirely on stolen employee passwords, attackers attempted to authenticate through applications that organisations had already authorised.
These application identities are commonly used by backup platforms, monitoring tools and business software. They allow applications to communicate with cloud services without requiring an employee to approve every request.
In this campaign, attackers reportedly obtained credentials associated with ConnectWise Cloud Backup applications. They then attempted to use those credentials to access Microsoft 365 customer environments.
The attackers also used ARTEX, an open-source AI-assisted penetration-testing framework. The tool helped automate parts of the attack process, including authentication attempts and follow-on activity.
The campaign demonstrates a risk that businesses sometimes overlook. Protecting employee accounts is important, but application identities can also become entry points when their credentials are compromised.
How many Microsoft 365 tenants were targeted?
The investigation reported attempted access against more than 2,250 Microsoft 365 tenants. This figure describes targeting activity rather than confirmed successful breaches.
A Microsoft 365 tenant is a dedicated cloud environment used by an organisation. It contains accounts, application identities, permissions and administrative settings.
Attackers may attempt to access many tenants without successfully compromising every one. Failed authentication attempts, successful sign-ins and confirmed data theft are different outcomes.
Reported attack figures
| Metric | Reported figure | Explanation |
|---|---|---|
| Microsoft 365 tenants targeted | More than 2,250 | Cloud environments subjected to attempted access |
| Accounts targeted by password spraying | 327 | Accounts included in an earlier campaign phase |
| Organisations targeted in that phase | 8 | Organisations associated with the password-spraying activity |
| Failed sign-in attempts | More than 151,000 | Unsuccessful authentication attempts |
| Time to privileged access | Under 3 hours | Reported duration in some successful attack sequences |
| Reporting year | 2026 | Year the investigation was published |
The figures show the scale of the activity, but they should not be combined into a single breach total. The available evidence does not establish how many targeted organisations experienced confirmed data theft.
How stolen application credentials created access risks
Microsoft 365 allows external applications to connect through Microsoft Entra identities and OAuth permissions. These connections support services such as backup, reporting and automated administration.
An application registration identifies software that requests access to cloud resources. A service principal represents that application within a particular tenant.
Applications may authenticate using credentials such as client secrets or certificates. Depending on their configuration, they can receive access tokens without requiring a person to complete an interactive sign-in.
This approach is useful for automated services, but it creates risks when application credentials are exposed.
An attacker with valid credentials may be able to authenticate as the trusted application and use permissions that the organisation previously granted.
Multifactor authentication for employee accounts does not automatically stop this type of access because application authentication can follow a different process.
However, possession of stolen credentials does not guarantee successful access. The credentials must remain valid, and the application must have permissions that allow the requested activity.
Why application permissions matter
Applications should receive only the permissions needed for their intended tasks. A backup application, for example, may require access to selected cloud resources, but it should not automatically receive unrelated administrative privileges.
Broad permissions increase the potential impact of compromised credentials.
The reported campaign also involved attempts to modify application credentials and permissions. Attackers may add new secrets or certificates to maintain access after an initial compromise.
Security teams therefore need to review more than employee passwords. Application credentials, consent grants, service principal permissions and administrator roles all require attention.
How AI agents were used in the campaign
ARTEX was reportedly used to automate parts of the attack. The framework supported activities that attackers would otherwise need to perform or coordinate manually.
Some attack sequences reached privileged cloud access in less than three hours. This suggests that defenders may have limited time to identify and contain suspicious application activity.
AI-assisted tools can help operators repeat authentication attempts, interpret responses and coordinate subsequent actions.
However, the available evidence does not show that AI independently carried out every stage of the campaign. Human attackers selected targets and used compromised credentials to support their operations.
There is also no verified comparison showing exactly how much faster ARTEX performed than conventional attack tools.
The main lesson is that automation can increase the speed of an existing security threat. Stolen credentials and excessive permissions remain important underlying risks.
Storm-0940 and the ConnectWise connection
The campaign was attributed in the published investigation to Storm-0940, a threat group assessed as aligned with the Chinese state.
This identification is a threat-intelligence assessment. It should not be treated as independent proof of responsibility beyond the evidence presented in the investigation.
The incident involved compromised credentials associated with ConnectWise Cloud Backup applications. The provider acknowledged unauthorised access to application credentials and published guidance for containment and restoration.
This type of incident creates supply-chain security risks because organisations may trust applications operated by external providers.
A business can maintain strong employee account security and still face exposure if a third-party application with existing permissions becomes compromised.
The risk is especially relevant to organisations that depend on cloud backup services, remote administration platforms and other integrations requiring ongoing access.
What the attack does not prove
The headline figure describes attempted targeting of more than 2,250 tenants. It does not establish that all those organisations were breached.
A successful authentication event also does not automatically demonstrate data theft. Investigators need additional evidence, such as resource access records, downloads or other activity, to establish what happened after authentication.
The published figures do not provide a complete breakdown of affected organisations by country, industry or company size.
We therefore cannot calculate the specific exposure of businesses in the US, UK or India from these figures alone.
The investigation also does not establish a general AI-driven increase in cyberattack success rates. The campaign involved AI-assisted tools, but compromised credentials and existing application permissions were central to the reported activity.
What this means for you
Businesses using Microsoft 365 should review the applications that can access their cloud environments. Employee account protection remains necessary, but application identity security deserves equal attention.
Review third-party applications
Check enterprise applications, application registrations and service principals in Microsoft Entra.
Identify which applications have access to business information and confirm that their permissions are still required.
Pay particular attention to applications with administrator roles or broad access to Microsoft Graph resources.
Check application credentials
Review recently created client secrets and certificates. Confirm that every credential change was approved by an authorised administrator.
Unexpected credentials may indicate an attempt to maintain unauthorised access.
Preserve relevant evidence before removing suspicious credentials. Rotate affected secrets and certificates through a documented response process.
Monitor service principal activity
Microsoft Entra provides audit and sign-in information that can help administrators investigate application activity.
Review service principal sign-ins, permission grants, role assignments and application credential changes.
Look for unusual authentication patterns, unexpected locations and changes that do not match approved administrative work.
Prepare for third-party security incidents
Maintain a register of critical cloud integrations and the people responsible for them.
When a provider reports compromised application credentials, determine whether your organisation uses the affected integration.
Follow the provider's incident-specific instructions and verify that access has been restored safely after remediation.
Microsoft 365 administrator checklist
Review all third-party enterprise applications and service principals.
Identify applications with broad or privileged permissions.
Inspect recent application credential additions and changes.
Check Microsoft Entra audit logs and service principal sign-ins.
Investigate unexpected permission grants and administrator roles.
Rotate compromised credentials and remove unauthorised access.
Preserve evidence before making incident response changes.
Review third-party provider advisories and restoration guidance.
The campaign shows why cloud security must cover application identities as well as employee accounts. The attempted targeting of more than 2,250 Microsoft 365 tenants demonstrates the potential reach of compromised third-party credentials. Regular permission reviews, credential monitoring and prompt incident response can help reduce the risk.
Where these numbers come from
This report uses figures from published security research and provider advisories covering October 2026. The figures come from the sources listed below, not our own tests. We have not independently measured attack speed, confirmed breach totals or the number of organisations that experienced data theft.
Sources
- Microsoft Threat Intelligence (21 October 2026). AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
- ConnectWise (October 2026). Trust Center Advisories
- Reuters (21 October 2026). Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
Questions people ask
What happened in the Microsoft 365 AI agent credential attack?
Attackers used stolen application credentials and AI-assisted tools to attempt access to more than 2,250 Microsoft 365 tenants in October 2026. The campaign involved trusted third-party application identities and the ARTEX framework.
Were all 2,250 Microsoft 365 tenants compromised?
No. The reported figure represents tenants targeted by attempted access, not a confirmed count of successful breaches.
How can stolen application credentials bypass Microsoft 365 MFA?
Some cloud applications authenticate using their own credentials rather than an employee's interactive sign-in. If attackers obtain valid application credentials, they may be able to use existing permissions without triggering a normal user MFA prompt.
What is ARTEX in the Microsoft 365 attack?
ARTEX is an open-source AI-assisted penetration-testing framework reportedly used to automate parts of the campaign. Its involvement does not mean AI independently conducted every attack.
How can I check whether my Microsoft 365 tenant was affected?
Review Microsoft Entra service principal sign-ins, application audit events and unexpected credential or permission changes. Check whether your organisation uses an affected integration and follow the provider's security guidance.
How can businesses protect Microsoft 365 application identities?
Limit application permissions, monitor credential changes and regularly review third-party integrations. Investigate suspicious service principal activity and rotate compromised credentials through a documented response process.