AI agents fuel real-world intrusions: 2,250 M365 tenants hit, 100+ firms compromised
cyb3rops · x · 2026-10-23
Security researcher @cyb3rops aggregates recent reports of threat actors using AI agents for large-scale intrusion — the trend he finds even more worrying than this week's vulnerability pile-up:
- ARTEX / ConnectWise: Microsoft says Storm-0940 hit 2,250+ Microsoft 365 tenants with up to 2,900 auth attempts per minute, gaining privileged cloud access in under 3 hours in some cases.
- ARTEX / South Korea: CrowdStrike found AI-driven attacks on Korean financial organizations, including exposed Claude Code sessions and ARTEX configs, with DeepSeek, GLM, and Grok in the attacker's setup.
- Cairn campaigns: NorForge uncovered 1,100+ attack projects in one cluster and 100+ compromised companies (confirmed by Reuters), at an estimated $5 cost per task.
- Others: 15+ compromised healthcare organizations in Argentina, government targets in multiple countries, ranging from custom multi-agent systems to off-the-shelf tools.
More from coding & agent
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- MCP Tip: One-Line Instructions Beat Long Tool Descriptions, 18/20 vs 3/10 in Evals — colinmcnamara · 2026-10-23
- DynaLM: Open-Source CPU-First LLM Inference Engine Seeks Feedback — Unlikely_Safety_7456 · 2026-10-23
- Software factories as code: Warp runs agents, runners and model routers from markdown/YAML repos — vikvang1 · 2026-10-23
- Dev uses Codex to remotely root a Samsung TV and strip eMudhra root certificates — charliermarsh · 2026-10-23
- Raindrop launches Change Reports to track how agent changes perform in production — HamelHusain · 2026-10-23