ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments

Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.

What this means for youBusinesses that use ConnectWise or Microsoft 365 should check for unexpected admin or credential changes and make sure multi-factor sign-in is on. At home, treat unexpected account or password-reset alerts as suspicious and confirm them directly with the provider.