Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs

Summary

A China-linked group tracked as VAPOR PANDA used the AI-powered penetration testing framework ARTEX to target more than 200 organizations in at least 14 countries over 11 days beginning October 17, according to CrowdStrike, with post-exploitation activity confirmed at nine. Microsoft separately reported that another China-linked group, Storm-0940, used ARTEX to automate attacks that in some cases gained privileged cloud access in less than three hours.

Mitigation

Analysts quoted in the source recommend continuously measuring endpoint protection coverage and alerting when machines stop reporting, enforcing SAML signature validation, restricting cloud access privileges, regularly rotating credentials, monitoring unusual account activity, and improving asset visibility across systems.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online