// Microsoft 365HIGH
A China-aligned threat group (Storm-0940) conducted a large-scale password spray and supply-chain attack against Microsoft 365 tenants in October 2026. Attackers exploited a compromised ConnectWise Cloud Backup application—trusted by thousands of organizations—to attempt sign-ins to over 2,250 tenants at 2,900 attempts per minute using an open-source AI agent framework (ARTEX). Microsoft reports the group achieved privileged access to multiple organizations in less than 3 hours. The campaign demonstrates how threat actors are automating offensive operations with agentic AI to scale attacks exponentially.
- A password spray hit 2,250 Microsoft 365 tenants at 2,900 tries (opens in a new tab)
- Storm-0940 ARTEX AI: 2,250 M365 Tenants Compromised(opens in a new tab)
- Week in review: PHP vulnerabilities patched, exploited Palo Alto(opens in a new tab)
// Get alerts for Microsoft 365