AI agents accelerate cloud breaches through trusted software
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, October 23rd, 2026.
Some cloud intrusions attributed to China-aligned Storm-0940 moved from initial targeting to privileged access in less than three hours. The group used the ARTEX AI penetration-testing framework along with stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity reached two thousand nine hundred sign-in attempts per minute, although most of the targeting was unsuccessful.
The important issue is how valid application credentials changed the attack. They allowed the group to operate through software customers had already trusted. Successful activity included cloud reconnaissance and attempts to change credentials, identities, groups, and privileged roles.
For leaders, incident-response timelines based on human attacker speed may no longer be fast enough. For defenders, non-interactive application access and service-principal credential changes need close monitoring. AI isn’t replacing familiar intrusion methods here. It’s helping attackers run them faster, in parallel, and at greater scale.
Revoke affected application access, review service-principal credential additions, and automate detection for abnormal cloud authentication.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
