Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Product
Microsoft 365
- Mentions · 7d21
- Mentions · 30d88
- All mentions157
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
157 articles · newest firstWiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
Microsoft posts tenth straight record quarter at $92.3 billion
Net income rose 32% to $36.6 billion, Microsoft Cloud grew 30% to $63.9 billion, and OpenAI revenue was $10 billion.
38
Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
72
Microsoft urges CISOs to govern AI agents as adoption surges
Microsoft says active agents in Microsoft 365 grew 15-fold year over year, and 18-fold in large enterprises.
24
Whitsett, NC warns of phishing from compromised town email
On October 22 the town found its Microsoft 365 account had sent a fake payment report with two attachments and a PDF password.
32
Skyw4lker device-code phishing targets US Microsoft 365 accounts
Password-protected contract lures and Google Sites lead victims into a real Microsoft login that hands over tokens.
68
CISA releases ScubaGear 2.0 and ScubaGoggles 1.1.0
ScubaGear now calls Microsoft 365 REST APIs directly, and ScubaGoggles adds an assured baseline plus Gemini controls.
36
CISA offers free ScubaGear and ScubaGoggles cloud configuration assessment tools
ScubaGear checks Microsoft 365 with PowerShell and Rego; alpha ScubaGoggles may misreport Google Workspace settings.
42
CISA’s ScubaGear and ScubaGoggles check cloud security settings
The existing SCuBA tools report configuration gaps in Microsoft 365 and Google Workspace but do not change tenant settings.
34
SkyW4lker phishing kit abuses Microsoft 365 device-code login
ANY.RUN linked 618 analyses from June through October 21, 2026, with monthly cases rising from 20 to 200.
74
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
32
Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
78
Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
78
Microsoft restores Teams after US disruption tracked as TM1526111
Automatic scaling returned throughput to healthy levels on October 26, but Microsoft has not named the trigger, user count or affected features.
34
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Opinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
32
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
73
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Stolen Microsoft 365 sessions replayed at 79 organizations
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
76
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Token-spraying campaign hits Microsoft 365 accounts for email fraud
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
74
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Microsoft links Storm-0940 to ConnectWise Cloud Backup attack
Compromised Cloud Backup application credentials were used to target more than 2,250 Microsoft 365 tenants.
80
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
76
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
74
Storm-0940 used agentic AI against 2,250 Microsoft 365 tenants
After a ConnectWise Cloud Backup compromise, sign-in attempts hit 2,900 a minute and some tenants saw privileged access in under three hours.
82
Storm-0940 used ConnectWise credentials against 2,250 Microsoft 365 tenants
Microsoft says the China-linked group used ARTEX and reached privileged cloud access at some organizations in under three hours.
82
Microsoft says Storm-0940 used AI to breach ConnectWise tenants
The group attempted more than 2,250 tenant sign-ins at about 2,900 per minute, often gaining access within three hours.
82
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
84
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
82
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
84
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
Huntress markets managed identity posture assessment for Microsoft 365
The page promotes Managed ISPM for continuous Microsoft 365 identity hardening and reports no incident, flaw, or exploitation.
14
ConnectWise suspends Cloud Backup after supply-chain credential attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
78
ConnectWise disables Cloud Backup after Microsoft 365 logins
Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.
74
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2021-22205100%10.0Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2014-6278100%—Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family)
- CVE-2026-698362%10.0Unauthenticated Deserialization RCE in Microsoft Entra ID
Appears with
- Microsoftvendor · 147
- Microsoftorganization · 49
- ConnectWisevendor · 30
- Huntressorganization · 29
- Googlevendor · 24
- OneDriveproduct · 20
- ConnectWise Cloud Backupproduct · 20
- SharePointproduct · 18
- Microsoft Graphproduct · 17
- Microsoft Teamsproduct · 17
- Storm-0940threat actor · 16
- Microsoft Entra IDproduct · 14
- ARTEXmalware · 13
- Exchange Onlineproduct · 13
- Proofpointorganization · 12
- Google Workspaceproduct · 12
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.