Wiz research published on October 22, 2026, reports that throughout October 2026 an actor has been using ARTEX, an open-source autonomous penetration-testing framework, against multiple IT and software vendors, concentrating on identity providers such as Okta, Entra and Cognito and on Microsoft 365 integrations. Wiz says the tooling, infrastructure and patterns overlap with Microsoft's earlier report on Storm-0940, and that the same actor is now expanding attempted supply-chain compromises into other software sectors.
ARTEX was published on GitHub in July 2026 by a Chinese developer and won Baidu's Agent+ red team challenge that September. Its division of labor is explicit: an operator supplies a target and an objective, a planner agent picks the next step, worker agents run tools such as nmap, curl and Impacket, and every result feeds a shared graph of assets and findings. The developer made the tool closed-source on October 8, but by then the code had been forked more than 12,000 times,
It reads your application first, then follows the map
The playbook Wiz reconstructed is highly repeatable: download JavaScript bundles, exposed source maps, runtime configurations and Swagger or OpenAPI documentation to map internal API routes; then repeatedly initiate sign-in flows, manipulate OAuth callbacks and state parameters, and probe SSO endpoints with unsigned JWTs, firing more than 60 route variations at Microsoft OAuth flows in just two minutes. Where sign-up is open, it registers with disposable mailboxes and immediately tests predictable identifiers for broken access control and cross-tenant data access, while account recovery and reset endpoints get the same relentless treatment. The pattern differs from the attack agent that hijacks unprotected model endpoints: that one steals compute, this one pries at identity.
The password-spray rhythm gives the machine away
The password spraying is even more telling: hundreds of users across Entra and Okta, aimed mainly at software engineers, in coordinated bursts lasting 20 to 60 minutes with a median gap of strictly one second between attempts, some users tried more than a dozen times. Single sessions ran 24 to 30 hours, blocked IPs were replaced within minutes, and when a login page started rate-limiting, the agent simply moved to another endpoint on the same host. Wiz is blunt about it: none of the individual techniques are novel; what is new is that they are chained into a pipeline that never tires and never gives up.
For defenders, the practical point is that existing detections for numerous failed logins, password spraying and unusual mass access-denied activity can still catch this, and its rhythm is more predictable than a human's. The real gap being opened is time: the window between an exposure appearing and being exploited keeps shrinking, so removing public documentation and source maps and patching identity flows has to keep pace with a prober that never sleeps.
