Microsoft says China-aligned Storm-0940 used AI framework ArtEx and OAuth apps to automate attacks on hundreds of organizations

Microsoft says China-aligned actor Storm-0940 used AI framework ArtEx to automate attacks on hundreds of organizations globally as early as September 2026, using OAuth applications to access and exfiltrate email and other data via Microsoft Graph. Authentication activity was detected in multiple customer environments, though data access has not been confirmed. Microsoft also assesses Storm-0940 caused the recent ConnectWise supply chain breach.

Detected & updated continuously · Source: Nebula