Previously authorized applications gave attackers a route into Microsoft 365 customer environments during a ConnectWise supply chain compromise, according to Microsoft. The company attributes the operation to Storm-0940, a China-state aligned group it says used ARTEX, an agentic AI penetration testing framework, to accelerate its attacks.
The findings appear among the developments covered in Security Affairs’ October 25, 2026 newsletter. Other disclosures include defensive guidance against SafePay ransomware, malware disguised as tools for cryptocurrency founders, and a prison sentence for a participant in hacking and fraud schemes.
ConnectWise customers urged to preserve evidence and review application activity
Organizations investigating the ConnectWise compromise should examine tenants where affected integrations were previously authorized, including integrations they have stopped using, Microsoft advised in its October 21 analysis. It recommends identifying applications by their IDs rather than their display names.
The access mechanism depended on trust already granted to applications. By abusing compromised application authentication material, Storm-0940 could authenticate to customer environments without an interactive user sign-in. Microsoft reported subsequent Microsoft Graph activity involving reconnaissance, changes to application credentials and attempts to alter privileges that could broaden access or help maintain it.
Microsoft’s attribution links Storm-0940 to the compromise of a ConnectWise multi-tenant application. Across the group’s broader ARTEX campaign, which Microsoft observed as early as September 2026, hundreds of organizations worldwide were targeted. Several attacks achieved privileged cloud access; in multiple instances, fewer than three hours elapsed between initial targeting and that access. Those results do not establish the outcome for every organization targeted or every ConnectWise customer.
For the ConnectWise operation, Microsoft described ARTEX assisting with scanning, reconnaissance, password spraying and abuse of OAuth applications. The company said the activity did not originate from a breach or vulnerability in Microsoft corporate systems, products or services.
Microsoft also cautioned against equating application exposure or a successful attacker authentication with confirmed access to, or theft of, customer data. Conversely, an empty search of Graph activity logs does not establish that access never occurred; investigators should assess those records alongside application permissions and service-principal authentication evidence.
Its containment advice is to leave affected ConnectWise application connections disabled pending formal restoration instructions from ConnectWise. Administrators should preserve configurations and investigation records before deleting enterprise applications, without postponing urgent containment to complete exports. Microsoft recommends reviewing activity from at least October 15, extending service-principal sign-in searches to October 1 where records exist, and investigating earlier related activity. Successful and failed authentications should be examined separately.
SafePay guidance focuses on entry points and account control
Businesses and critical infrastructure in North America, South America, Europe and Australia have faced a highly active SafePay operation since August 2024, according to the advisory published by CISA on October 20.
The advisory describes several routes into a victim’s network: phishing, password theft or guessing, and exploitation of weaknesses in security systems. After entry, attackers secure control through newly created or hijacked accounts. Legitimate system utilities then support movement between systems, searches for valuable files and interference with security protections. Victims ultimately lose access to encrypted files and receive a demand for cryptocurrency payment.
The recommended defenses address those stages: patch known exploited vulnerabilities, give particular attention to internet-facing systems such as firewalls and other edge devices, restrict administrative privileges and tools, and strengthen identity and credential management. The agencies also call for multifactor authentication, especially for webmail, VPNs and access to critical systems.
The published indicators were observed between November 2024 and August 2026. Defenders are advised to investigate the context before blocking listed IP addresses or tools, because some files in the advisory are legitimate utilities.
Fake Web3 accelerator offered audits that concealed malware
A separate operation used the appearance of a start-up accelerator to persuade cryptocurrency founders to engage with malicious developer tools, Elastic Security Labs reported on October 12.
Operating under the Apex Accelerator identity, the group spent months developing a public presence and offered security audits, coding tools and free Claude and Gemini credits. Its Apex Arena website claimed more than 200 portfolio projects and over $124 million raised. Elastic described fake reviews and an invitation page for an advertised in-person event as further efforts to establish credibility.
An alert concerning @apexacc/cli began Elastic’s investigation. Researchers concluded that the npm package had been malicious when first published, rather than becoming malicious through a later compromise of a legitimate package. The publisher subsequently released another malicious package, @apexacc/audit.
Elastic reported malware and backdoors for both macOS and Windows, including CloudSyncD on macOS and a custom Windows information stealer that sent stolen data through Telegram. A repackaged legitimate coding agent also routed model requests through infrastructure controlled by the attackers.
The audit functionality offered false reassurance. Researchers found fabricated results across all 18 tools in @apexacc/audit. Separately, they submitted a fictitious project to the remote scoring service used by @apexacc/cli; it received 51/100 despite the service reporting that its AI scorer was unavailable.
Tax-business intrusions lead to eight-year prison term
Chukwuemeka Victor Amachukwu, 40, of Nigeria, received an eight-year prison sentence following guilty pleas to conspiracy to commit computer intrusions and conspiracy to commit wire fraud, the U.S. Attorney’s Office for the Southern District of New York announced on October 19.
Prosecutors’ account of court records and statements traces the tax-business hacking scheme to at least around 2019. Spearphishing enabled conspirators to enter U.S. tax preparation firms’ systems and steal tax and identifying information concerning at least approximately 800 customers. Across the schemes, the conspirators obtained stolen identity information belonging to thousands of people.
Fraudulent tax filings sought at least approximately $8.4 million in refunds, with at least approximately $2.5 million obtained. Additional fraudulent claims through the Small Business Administration’s Economic Injury Disaster Loan program yielded at least approximately $819,000. In a separate investment fraud, Amachukwu impersonated a wealthy overseas financier to sell nonexistent investments in standby letters of credit; that scheme generated more than $7 million for him and his co-conspirators.
The sentence also includes one year of supervised release, restitution of $3,647,629.39 and forfeiture of $10,846,634.39.
Microsoft outlines controls for agents inside organizations
Alongside the incident disclosures, Microsoft used an October 19 announcement to describe extensions to Project Perception for managing enterprise AI agents.
The proposed controls give agents identities and permissions separate from their sponsoring employees. Microsoft described Dynamic Permissions for limiting authority to a task and its duration, Dynamic Agent Risk for reassessing behavior and context, and Dynamic Conditional Access for changing access as risk evolves. Guardian Agents are intended to support investigation and containment.
These are Microsoft’s capability claims. Its stated design places enforcement outside the model, allowing independent controls to restrict resources, remove write permissions, require verified human approval or halt an agent when warranted.
