Chinese spies used AI to hack into 2,250 Microsoft 365 accounts

Microsoft says a Chinese spy group used AI to go after more than 2,250 Microsoft 365 business accounts. The way in was stolen digital keys belonging to ConnectWise, a company that makes tools IT providers use to manage their customers. Most attempts failed. Some did not, and in some cases the attackers reached top-level access in under three hours.

What happened

The group is called Storm-0940. Microsoft describes it as a China-linked espionage crew that has been active since at least 2021. It used a free, open source AI tool called ARTEX, built for security testing, to automate much of the work. Microsoft says the group began using it as early as September.

Between October 10 and 14, the attackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations. None succeeded. Then they switched to stolen ConnectWise application credentials, which let them use permissions customers had already given to ConnectWise services. No user login was needed.

Why the speed matters

With those keys, the attackers tried to get into more than 2,250 Microsoft 365 tenants. A tenant is one organization's Microsoft 365 setup. At times they made 2,900 attempts a minute. Microsoft also saw AI-sped activity that included scouting, changes to app credentials and attempts to raise privileges. That could let attackers stay in even after the original stolen keys are cut off.

The tricks themselves are old: stolen credentials, password guessing and abusing apps. The change is pace. AI helped the group do them faster.

Who it affects

Targets included government agencies, defense contractors, banks, manufacturers and tech firms around the world. ConnectWise shut down its Cloud Backup, SaaS Security and Cloud Management services after finding unauthorized access. If your business or its IT provider uses any of them, take this seriously.

Others can be a little calmer. Most attempts failed, and Microsoft saw no successful logins from the password-guessing campaign. A successful login also does not mean data was taken.

What to do

The alert box above lists the steps. The key point is that cutting off the stolen keys may not be enough. Check what apps can reach your Microsoft 365 and whether anything was changed.

What is not known yet

• How many customers were actually compromised.
• Whether any data was stolen.
• How many organizations still have attackers inside.

ConnectWise CEO Manny Rivelo says the company has contained the affected application connections and is gradually restoring services. He also acknowledged that shutting those connections down would not necessarily remove attackers who already have a foothold.

ConnectWise had an earlier incident in May 2025, when a nation-state actor broke into its systems. Nothing suggests the two are linked. Microsoft also says attackers in several regions are using ARTEX, so this tool is not limited to one group.