ARTEX abuse expands as cybercriminals target financial sector

Summary

In October 2026, the financially motivated threat actor Storm-3358 began targeting financial-sector organizations with the agentic AI offensive framework ARTEX. Microsoft has observed the group pairing ARTEX with conventional automated tools to exploit flaws including anonymous file upload and server-side request forgery (SSRF) and to install open-source remote access trojans (WISP, vshell, and AdaptixC2) for persistence and lateral movement.

Mitigation

Microsoft's guidance centers on detection rather than a single fix: it notes behavioral signals such as rapid, varied requests and distinctive default tool user agent strings, and recommends deception measures like honeypots, decoys, tarpits, and fake wins (e.g., Microsoft Sentinel Deception). It also says Microsoft is providing indicators of compromise (IOCs) to help defenders detect related activity.

Related items

• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSame vendor · Microsoft Security Blog
• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSame vendor · BleepingComputer
• Info​​​​What’s new in Microsoft Security: November 2026Same vendor · Microsoft Security Blog
• MediumTop AI agent security resources — November 2026Same vendor · Adversa AI Blog
• InfoRadio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath ItSame vendor · The Hacker News