Mmastodon EnvironmentWeather first seen 2 d ago, last 2 d ago, peak #12
China-linked Storm-0940 used AI agent in ConnectWise OAuth attack
Original: China's Storm-0940 let an AI agent loose on stolen ConnectWise OAuth apps - Global Admin in minutes, no MFA. 9 detection
The China-linked hacking group Storm-0940 reportedly deployed an AI agent to abuse stolen ConnectWise OAuth application credentials, reaching Global Administrator access within minutes without triggering multi-factor authentication. The campaign, tracked as ARTEX, reportedly yielded nine detection signatures and 24 indicators of compromise, with full analysis published for defenders to check their environments.
Why now: The use of an autonomous AI agent to escalate to Global Admin without MFA is a striking escalation in offensive automation, prompting security teams to review their OAuth apps and detections.
Evidence
API: https://socialmediatrends-api.osmike.com/v1/trends/3162033