Microsoft says financially motivated attackers began using the agentic AI framework ARTEX against financial organizations in October, exploiting internet-facing systems and installing remote access malware. The group, tracked as Storm-3358, operates from Cambodia and mainly pursues financial organizations across Southeast Asia, with some large financial organizations elsewhere also targeted. Microsoft observed it combining ARTEX with conventional automation to find exposed systems and exploit flaws.
The weaknesses exploited include anonymous file uploads and server-side request forgery, according to Microsoft. Storm-3358 has deployed remote access trojans including AdaptixC2, WISP and vshell to maintain access and move between systems. Microsoft also observed ARTEX agents downloading that malware onto compromised machines through utilities such as curl and netcat, putting familiar attack tools alongside the AI framework.
Read more: Microsoft Warns of Exchange Server Zero-Day Flaw Actively Exploited in Attacks
Across recent attacks involving ARTEX, Microsoft has seen agents exploit web applications, maintain access through web shells on compromised servers and obtain credentials from both public sources and compromised systems. Attackers have also used compromised cloud identities to retain access and steal data. Microsoft says ARTEX agents can attempt passwords repeatedly, spray passwords across accounts, probe APIs and extract database contents.
The tools alone offer an imperfect detection signal: Microsoft says blocking their recognizable network characteristics will not halt an AI agent because it can quickly change them. Defenders can instead watch for many different requests arriving within a short interval, followed by rapid variations or movement into another attack stage. Microsoft says ARTEX uses established utilities, including Nmap and browser automation through Playwright, whose default traffic characteristics can help flag activity.
Microsoft says its tests found that decoy targets and other deception measures reduced traffic reaching real assets and generated signals useful for attribution. Tarpits expend an agent’s time and budget, while fabricated evidence of success can persuade it to stop pursuing its objective. The company is also supplying compromise indicators, although attackers can rotate their source addresses through proxies and VPNs to evade static detection.
The findings follow Microsoft’s disclosure this week that attackers were using an agentic offensive framework to hunt public GitHub repositories for exposed credentials and AI inference API keys. In February, Microsoft separately warned of Python infostealers targeting macOS, with stolen information including browser credentials, session tokens and cloud credentials. For the ARTEX activity, Microsoft advises reviewing files and hosts identified through curl download hunting because the utility also serves legitimate purposes.
