Wiz: Actor Uses ARTEX AI Pen-Testing Agent Against IT and Software Vendors

What Wiz observed

According to Wiz, the actor made repeated attempts to uncover authentication bypasses, enumerate APIs and access customer data of the targeted vendors across multiple environments. Wiz says its observations overlap with Microsoft's recent report on Storm-0940, a Chinese-state aligned actor linked to a recent supply-chain attack involving stolen vendor credentials and downstream Microsoft 365 tenants.

Wiz adds that it saw the same infrastructure, tooling and attack patterns aimed at the sector as a whole. By pivoting on identified TTPs and IOCs, it also found the same actor trying to extend supply chain compromises into other software sectors.

What is ARTEX?

ARTEX is an open-source autonomous penetration testing framework. A Chinese developer published it on GitHub in July 2026, and it won Baidu's "Agent+" red team challenge that September, according to Wiz. An operator supplies a target and an objective. A planner agent then chooses the next step, worker agents run tools like nmap, curl and Impacket, and every result feeds a shared graph of assets and findings.

Attackers picked it up within weeks, Wiz says. ARTEX artifacts surfaced in attacks on South Korean banks in late September and on Japanese companies in October, and Microsoft and Zscaler have tied it to two separate actors. The developer made the tool closed-source on October 8, by which time the code had more than 12,000 forks.

The attack playbook

Wiz describes a consistent sequence across the investigated environments:

• Map the application: download JavaScript bundles, exposed source maps, runtime configurations and Swagger/OpenAPI documentation to find internal API routes.
• Probe authentication: repeatedly start sign-in flows, manipulate OAuth callbacks and state parameters, test unsigned JWTs, and probe SSO and Microsoft 365 endpoints.
• Attack identity providers: password-spray corporate Okta and Entra ID environments and target proprietary login pages.
• Abuse account recovery: repeatedly call password-reset, username-recovery, activation and reset-token endpoints.
• Test tenant isolation: register accounts with disposable email addresses, then manipulate predictable identifiers to probe for broken access controls and cross-tenant data access.
• Adapt to defenses: rotate IP addresses when blocked and keep changing user agents.

In the logs, Wiz says the agent always started by reading the application itself, requesting source maps and config files within minutes of first contact. It then called internal API routes by name, which appear only in the source maps it had just downloaded. In one example, a forged token decoding to {"alg":"none"} was sent to more than 60 variations of SSO routes in two minutes.

Password spraying and persistence

Wiz also tracked a large password spray campaign that hit both Entra and Okta. The attacks targeted hundreds of users in coordinated bursts. Each burst used its own user-agent string, had a median gap of one second between attempts, and lasted 20 to 60 minutes. The agent mainly went after accounts belonging to software engineers, and some users faced more than a dozen login attempts.

Some sessions lasted 24 to 30 hours, and when IPs were blocked, new addresses appeared within minutes. Wiz counted more than 15 different user-agent strings, from Python clients and curl to headless browsers and self-describing identifiers such as ReconProbe/1.0. Most attempts failed, Wiz says, but "the true threat lies in the methodology."

Signs of an agentic attack

Wiz states that none of the individual techniques is novel, but together they point to an AI agent. It lists steps chained automatically, each step using the output of the last, automatic adaptation to rate limiting and blocks, and illogical choices such as testing generic payloads on heavily scrutinized Microsoft OAuth flows, which a skilled human is unlikely to do.

What it means for defenders

Wiz argues that as AI makes reconnaissance and exploitation faster and easier to scale, defenders need to shorten the gap between exposure and remediation. It points to its AI Threat Readiness Framework and its AI Red Agent, and says Wiz customers can consult a Threat Intel Center alert on the campaign. According to Wiz, existing detection rules can also identify this activity, for example rules for numerous failed logins across multiple users followed by a successful admin login.