Stolen App Keys Let AI Agents Sign Into Microsoft Tenant Accounts

A supply chain breach centered on ConnectWise gave attackers access to Microsoft 365 customer accounts, and Microsoft has traced the operation to Storm-0940, a China-state-aligned group. The attackers used four stolen application credentials belonging to ConnectWise apps to authenticate as the apps themselves, without any interactive user sign-in. That removed the need to defeat a login prompt.

The numbers describe the pace. Microsoft's Security blog reported unauthorized access to a multi-tenant ConnectWise application followed by attempted sign-ins at more than 2,250 Microsoft 365 tenants. Some intrusions reached privileged access less than three hours after initial targeting. From a single IP range, the agents recorded more than 200 sign-ins in under four minutes. A separate password-spraying effort targeted 327 accounts across eight organizations, producing more than 151,000 failed logons and no successes. At its peak on Oct. 11, that spray reached 2,900 attempts per minute, all unsuccessful, with more than 111,000 failures logged that day. Almost 98% of that activity was locked out.

Microsoft attributed the speed to ARTEX, an open-source framework it described as "a system of LLM-driven agents that run an autonomous penetration test." The company said ARTEX accelerated scanning, reconnaissance, password spraying and abuse of OAuth applications. Such agents can operate around the clock with little human involvement, Microsoft said.

Storm-0940 has been active since 2021 and has no known industry aliases. Targeted sectors in this campaign included aerospace and defense, semiconductors, government and think tanks, among 14 industries listed in total. Microsoft said the activity did not stem from a compromise of, or a vulnerability in, its own systems, products or services.

Security firm Huntress observed one tenant on Oct. 15 in which an app added itself to the Global Administrator role, the behavior behind the Microsoft Defender alert "Application self-assigned Global Administrator role." By Oct. 16, Huntress had confirmed unauthorized sign-ins at 162 tenants. A day later it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, more than 300 of them successful. The attackers moved through tenants in sorted order, seconds apart, suggesting "a script working from a target list."

ConnectWise detected the unauthorized access and suspended Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management as a precaution. It began a phased restoration expected to take several days and said it has no indicators so far that partner backup data was compromised. Microsoft said an affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken. The company advised customers to keep affected app connections disabled until formal restoration instructions are issued.