Agentic AI Attacks Are Here: What We’re Seeing with ARTEX, and How to Protect Your Org

Salesforce Threat Intelligence Salesforce Threat Intelligence has observed multiple threat actors using the AI-enabled offensive framework ARTEX to attempt to gain access to Salesforce environments for various objectives. Our findings are consistent with what our industry peers are reporting. We want to share what we’ve seen and what we recommend. What is ARTEX? ARTEX is an open-source, multi-agent offensive framework originally developed to simplify autonomous penetration testing of systems and networks. Using ARTEX, a malicious actor simply provides a target and an objective, and AI agents coordinate much of the resulting intrusion. It combines existing attack techniques with continuous planning, parallel execution, and on-the-fly code generation. The original framework was published to a GitHub repository that has since been taken down by its creator, but community forks of the repository continue to circulate. The techniques themselves are not necessarily new. The agentic operating model is. It lets malicious actors sustain multiple operations at once, recover from failures, and navigate complex environments at a speed and scale that challenge human-led response. Google Threat Intelligence has described the in-the-wild use of these frameworks as a critical inflection point for defenders. What the industry is reporting Due to increased reporting on threat actor use of ARTEX across the landscape, we assess ARTEX should be treated as an accessible capability for numerous threat actors, rather than a tool attributed to a single actor or nation state. Threat actors continue to use a wide variety of AI tooling to assist them in a range of operations, from espionage to financially-motivated cyber crime. Nation-state use: Microsoft attributes a large-scale campaign using ARTEX to Storm-0940, a China-state-aligned actor, in which several attacks reached privileged cloud access in under three hours. The actor used a vendor’s stolen app credentials to attempt sign-ins to more than 2,250 Microsoft 365 tenants. Financially motivated use: Storm-3358 began using ARTEX in October to target financial organizations, combining it with conventional tools. Leaked secrets: Microsoft observed actors using an agentic framework to run large volumes of GitHub queries for exposed credentials and application secrets. What Salesforce Threat Intelligence has observed We have observed a stolen-credential-driven campaign targeting Salesforce customer environments through compromised application credentials and trusted integration sessions. This activity did not result from a vulnerability in the Salesforce platform, and as always, we directly notified any affected customers. We’re sharing our insights on ARTEX to help defenders secure their systems. We have observed several tactics, techniques, and procedures (TTPs) that suggest the activity was AI-assisted, specifically: Using Salesforce environments as relays: Executing outbound requests through Apex and abusing configured Named Credentials to reach connected services and move laterally. Deploying code tailored to the compromised environment: Inspecting existing Apex source and integration settings, then deploying custom Apex, REST endpoints, and Visualforce components to support data access, outbound requests, and persistent access. Testing the compromised account’s effective permissions: Enumerating users, profiles, and permission sets, then attempting privileged operations such as executing Apex, creating users, assigning permissions, and modifying integration settings. Continuing across unsuccessful execution and access attempts: Trying multiple code-execution and integration-access paths, including anonymous Apex, deployed components, and different endpoint and authentication configurations. In each case, audit logs show the activity cluster rapidly and dynamically writing automation to interact with the Salesforce environment. The operational scale and execution velocity observed throughout the campaign far exceed standard human operator capabilities, strongly indicating an agentic-like operator. A hallmark of this AI-driven generation is the automated deployment of custom Apex code immediately following initial access. The threat actor’s rapid development and refinement of code to abuse trusted integrations and reach connected systems is consistent with AI-assisted operations. Recommended guidance This campaign reinforces the need for Salesforce customers to implement: Phishing-resistant MFA (PRMFA) for all users. Today, we actively enforce PRMFA for Salesforce admins and MFA across all of our users. We strongly recommend customers further extend the use of PRMFA to all users in their organizations wherever possible. User Email Domain Restrictions for all user accounts. More details here . Short-lived, context-bound OAuth tokens. Review connected apps and integrations, remove unused ones, apply least privilege, and rotate client secrets. More on how we are enforcing this control across our user base here . Step-up authentication for sensitive actions , such as bulk data export and permission changes. More details here . IP allowlisting enforcement for users and connected apps. More details here . Behavioral detection that identifies complete attack sequences , not just single events. Turn on Event Monitoring and stream logs to your SIEM. Look for a wide variety of requests in a short time, retries of technique variations, and fast progression to next-stage actions. Secret hygiene. Scan repositories for exposed credentials. If you find exposed secrets, assume the secrets and associated applications are compromised. A fast response plan. Know how to disable an integration, revoke tokens, and reset credentials within hours. Additional resources Our original analysis incorporates vendor intelligence from Google Threat Intelligence Group, CrowdStrike, and Microsoft. ARTEX abuse expands as cybercriminals target financial sector AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ARTEX and Friends: Enter Agentic Offensive Frameworks Agentic attack tools accelerate reconnaissance of identity flows We publish threat intelligence to help the security community and our customers defend against threats we observe. Sharing this information supports collective defense. This report is intended for educational and defensive purposes and does not constitute a notice of a security incident / legal notice. Security Resources Curious about more ways to bolster the security of your Salesforce org? Check out our guide for additional guidance and resources Get the resources