Microsoft: Storm-0940 used OAuth apps to steal data via Graph
- Storm-0940 used OAuth apps to access data via Microsoft Graph
- Authentication activity detected in multiple customer environments
- Data access by the threat actor remains unconfirmed
- Group previously used Artex AI to accelerate ConnectWise attacks
*this image is generated using AI for illustrative purposes only.
Microsoft identified that the China-aligned threat actor Storm-0940 used OAuth applications to access and exfiltrate email and other data through Microsoft Graph. This activity was detected in multiple customer environments, although data access has not been confirmed.
The group, previously known for deploying agentic AI to accelerate supply-chain compromises, now leverages legitimate authentication protocols to bypass traditional security controls. The use of OAuth allows attackers to maintain persistent access to cloud resources without triggering standard intrusion detection systems.
Attack methodology evolution
Storm-0940 has expanded its toolkit beyond the Artex agentic AI system. While Artex was used to automate post-exploitation tasks in the ConnectWise ScreenConnect compromise, the new findings highlight a shift toward identity-based attacks.
Key aspects of the campaign include:
- Use of OAuth applications to authenticate and access Microsoft Graph APIs.
- Targeting of email and other data within compromised tenants.
- Detection of authentication activity in multiple customer environments.
- Previous reliance on agentic AI (Artex) to scale lateral movement.
The integration of AI-driven automation with OAuth abuse suggests a move toward high-speed, low-noise intrusions that can outpace traditional detection mechanisms. By using valid tokens, the attackers blend in with normal administrative traffic.
Implications for cybersecurity
The incident underscores the growing sophistication of advanced persistent threats (APTs). The combination of AI-accelerated initial access and OAuth-based persistence creates a dual-layer threat model that challenges conventional perimeter defenses.
| Component | Detail |
|---|---|
| Threat Actor | Storm-0940 |
| Affiliation | China-aligned |
| New Vector | OAuth Apps / Microsoft Graph |
| Prior Tool | Artex (Agentic AI) |
| Status | Data access unconfirmed |
Security protocols must now account for anomalous patterns in API usage and token issuance, not just network traffic anomalies.
How might Microsoft adjust its default OAuth permission policies or consent workflows to mitigate the risk of token abuse by state-sponsored actors?
What specific anomalies in Microsoft Graph API usage patterns are security vendors developing to distinguish Storm-0940's activity from legitimate administrative traffic?
Will the integration of agentic AI with identity-based attacks prompt regulatory bodies to mandate stricter conditional access controls for enterprise cloud tenants?
15
Access Market Heat-map & Insights 
Create, Save & Share your Screener 
Use 200+ Screening Filters 
