Microsoft Threat Intelligence

Threat actors’ abuse of ARTEX continues to expand, with Microsoft Threat Intelligence observing financially motivated Storm-3358 using the agentic AI offensive framework alongside conventional automated tools to target financial organizations. msft.it/6016aA2bG

Storm-3358 has used ARTEX to scan internet-exposed systems, exploit security flaws including anonymous file upload and server-side request forgery (SSRF), and install open-source remote access trojans (RATs) for persistence and lateral movement.

This activity illustrates a continuing trend of threat actors using agentic AI penetration testing frameworks to accelerate attack chains. Read our latest blog to get indicators of compromise (IOCs), along with mitigation, detection, and hunting guidance.

Microsoft Threat Intelligence has observed threat actors using agentic AI tools to search public GitHub repositories for exposed secrets and then using stolen secrets for further malicious activity against the compromised organization. msft.it/6017aA1bS

Searching open code repositories for exposed credentials, secrets, keys, and other authentication material is a well-documented technique, but agentic tooling like ARTEX allows threat actors to scale and accelerate scanning for secrets, analyzing the output, and conducting follow-on attacks.

Microsoft has also investigated follow-on activity related to successful service principal sign-ins involving multiple application IDs, including cases where a single multitenant application credential was used across multiple tenants. The threat actor used the compromised credentials for cloud resource discovery, and credential and data exfiltration.

Microsoft encourages organizations to scan their code for secrets. In addition to removing the secrets from the code base, affected organizations should immediately rotate any exposed keys or credentials. Read our blog for more details, detections, and guidance for public monitoring and reducing exposure.

Amid conflicting reports about PHP2Shell, understanding exposure and conditions for exploitation helps defenders prioritize patching. This Microsoft Threat Intelligence Podcast episode brings together exploit research & IR perspectives on PHP2Shell. msft.it/6014aABdn

Elliot Volkman speaks with Carly Sherrod, Director of Security Research at Microsoft Incident Response, and Spencer McIntyre, Director of Exploit Development at VulnCheck, about the research and response behind PHP2Shell.

At the time of recording, Carly described seeing numerous malformed HTTP requests but limited evidence of successful remote code execution within her team’s incident response work, even as exploitation had been reported in the wild. Spencer explains why many early proofs of concept did not work in realistic production environments, and why an exploit that works against one application does not necessarily work against another.

The discussion connects understanding PHP exposure with identifying critical business systems, reviewing telemetry for signs of compromise, and prioritizing patching. Hear more about assessing PHP2Shell risk and making evidence-based response decisions.

Q3 (July – September) 2026 showed how familiar business workflows can undermine technical signals: attackers spoofed trusted service domains, exploited security overrides, and disguised phishing and malware as routine workplace requests. msft.it/6017aftFJ

Microsoft detected approximately 129 million malicious messages spoofing familiar business-service sender domains. Many were associated with organization- or user-configured exception overrides, even after being flagged as malicious, highlighting how overly broad exceptions can also expose workflows to impersonation.

Two campaigns show how familiar work requests supported account compromise and malware delivery: personalized salary review documents led to device code phishing, while purchase order and payroll lures delivered Agent Tesla malware.

Learn more about email-based phishing threat trends from Q3 and get detections, mitigations, and hunting guidance from this Microsoft Threat Intelligence blog post.

Microsoft Security Research has identified a fake-download campaign targeting users searching for cracked software, free games, plugins, and other utilities to distribute trojanized installers that can monetize compromised devices in three different ways: msft.it/6012a4u2w

- Routing third-party internet traffic through the compromised devices
- Enrolling devices in a distributed-computing platform
- Installing additional utility software

The trojanized Inno Setup-style installers launch executable payloads staged in temporary directories and track each component’s installation outcome separately. A failed or blocked installation does not necessarily stop the rest of the bundle.

Organizations can reduce exposure to this activity by blocking the use of untrusted software sources, enabling potentially unwanted application (PUA) protection, and monitoring for unexpected software installations and persistence mechanisms.

Read the blog for technical details, indicators of compromise (IOCs), mitigation guidance, Microsoft Defender detection info, advanced hunting queries.