An attacker running ARTEX, an open-source AI agent built for penetration testing, spent October hammering identity providers and login pages at multiple IT and software vendors, according to new research from Wiz. The activity overlaps with Storm-0940, the China-state aligned group Microsoft this week tied to the ConnectWise supply chain compromise, and Wiz says the same infrastructure, tooling and attack patterns are being aimed at the software sector as a whole.
That matters because a software vendor is a doorway. Wiz says the agent repeatedly tried to uncover authentication bypasses, enumerate APIs and reach the customer data held by the vendors it targeted, and that pivoting on the actor's techniques and indicators showed it expanding its attempted supply chain compromises into other software sectors.
A pentest tool with 12,000 forks
ARTEX was published on GitHub by a Chinese developer in July 2026 and won Baidu's "Agent+" red team challenge that September, Wiz says. An operator supplies a target and an objective; a planner agent picks the next step, worker agents run tools such as nmap, curl and Impacket, and every result feeds a shared graph of assets and findings. Attackers adopted it within weeks: ARTEX artifacts surfaced in attacks on South Korean banks in late September and in attacks on Japanese companies in October. The developer made the tool closed-source on October 8, by which point the code had more than 12,000 forks.
It reads the app before it attacks it
Across the environments Wiz investigated, the playbook was consistent. Minutes after first contact the agent downloaded JavaScript bundles, exposed source maps, runtime configuration files and Swagger or OpenAPI documentation, then began calling internal API routes whose names appear only in those source maps. It manipulated OAuth callbacks and state parameters, fired unsigned JSON Web Tokens (login tokens with no valid signature) at more than 60 variations of single sign-on routes in two minutes, and hammered password-reset, username-recovery and activation endpoints. Where sign-up was open, it registered with a throwaway mailbox, confirmed the account and immediately requested another company's data.
On Okta and Entra ID it ran password sprays in coordinated bursts lasting 20 to 60 minutes, each burst with its own user-agent string, a median gap of one second between attempts and a focus on accounts belonging to software engineers. Some sessions lasted 24 to 30 hours. Blocked IP addresses were replaced within minutes, and when a login page began rate-limiting, the agent simply moved to another endpoint on the same host.
Wiz says most of these attempts failed. Its point is that an agent does not get tired: it keeps iterating until it finds a single weak spot.
Hunt for spray bursts and source-map pulls
Wiz says existing detections catch this behavior, including rules for numerous failed logins across many users followed by a successful admin login, password sprays from a single IP, Okta user password sprays and unusual mass access-denied activity, and it urges defenders to shorten the gap between exposure and remediation. The playbook also suggests where to look first: production sites that expose source maps, runtime configs or API documentation, and account-recovery or self-registration flows that could leak data across tenants.
Indicators published by Wiz (Microsoft attributes the three 144[.]172[.]64[.]x addresses to Storm-0940):
- 104[.]194[.]150[.]21
- 144[.]172[.]64[.]60
- 144[.]172[.]64[.]99
- 144[.]172[.]64[.]128
- 167[.]88[.]172[.]97
- Self-describing user agents including ReconProbe/1.0 and norma/0.4
Wiz cautions that many of the user agents it lists are not unique to this actor and will be noisy if hunted on their own.
None of the individual techniques is new, as Wiz itself notes. What is new is a tireless agent chaining them against the companies whose access reaches everyone else, which turns a vendor's weakest login page into a supply chain problem.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.