Attack
Wiz identified in October 2026 an actor using tools linked to the AI agent ARTEX against software and IT vendors.
Wiz's observations match Microsoft's report on the Chinese state-aligned actor Storm-0940.
The activity focused on the identity providers Okta, Entra and Cognito and on Microsoft 365 integrations.
The agent downloads exposed source maps then calls the internal API routes it discovered by their name.
Some sessions lasted from 24 to 30 hours, but most of the attempts observed failed.