An AI Hacking Tool Fired 2,900 Login Attempts a Minute: Is Two-Factor Authentication On for Your Company Accounts?

ARTEX, a hacking tool that runs its attacks with AI agents, is now within reach of any attacker: on November 5, 2026 Censys counted more than 1,465 servers running it exposed on the internet, and a China-linked group has already used it for a password-guessing campaign that peaked at 2,900 login attempts a minute. The cheapest and fastest protection is two-factor authentication: a Microsoft study found it cuts the risk of account compromise by 99.22%. Do three things this week: make two-factor authentication mandatory on every email and admin account, switch off legacy mail protocols, and ask for a report of who has not enrolled yet. If your company connects outside apps to Microsoft 365, also read our article on the ConnectWise breach, because that gap is not closed by two-factor authentication alone.

What is ARTEX and why should you care?

ARTEX is an open-source framework for automated penetration testing that its developer published on GitHub on July 26, 2026. According to the Censys report published on November 5, 2026, one AI agent plans the attack and breaks it into tasks, other agents run the scanning tools and report back, and the loop repeats until the goal is reached. Microsoft describes it as running an attack from reconnaissance through data theft with little human involvement.

After its use in real attacks came to light, the developer announced it would go closed-source and took the repository down, but archived copies and rebrands are still circulating. Censys counted about 815 independent deployments after removing identically configured servers, including 726 servers in the United States, 387 in Hong Kong and 177 in China. In practice, what used to take a team of attackers now takes one person and a free tool.

What did attackers actually do with it?

In its report published on October 21, 2026, Microsoft documented a campaign by the group it tracks as Storm-0940 that used ARTEX to guess passwords automatically between October 10 and 14:

• 327 accounts across 8 organizations were hit with password spraying, which means trying common passwords across many accounts.
• More than 151,000 failed sign-ins, over 111,000 of them in a single day, peaking at 2,900 attempts a minute on October 11.
• 48 accounts each received more than 1,000 failed attempts.
• In other attacks by the same group, less than 3 hours passed between first targeting and privileged access to cloud infrastructure.

Microsoft says it saw no successful sign-in from that particular guessing campaign, because account lockouts absorbed most of it. But TechCrunch summed up on November 6 that many of these attacks exploited simple weaknesses: weak or known passwords, and no multi-factor authentication.

Why a password alone is no longer enough

It is not. A machine does not tire or sleep, and any account with a reused or previously leaked password will be tried sooner or later. Two-factor authentication adds a second factor the attacker does not have: a code in an app on the employee's phone, a security key, or a passkey. Microsoft researchers analysed real accounts that showed suspicious activity and found, in their published study, that two-factor authentication cuts the risk of compromise by 99.22%, and by 98.56% even when the password has already leaked. They also found authenticator apps outperform SMS codes, though both are far better than nothing.

An important warning from Microsoft documentation: legacy mail protocols such as IMAP, POP3 and SMTP do not support two-factor authentication, so an attacker can sign in through them and bypass the protection entirely. Turning it on is not complete until they are switched off.

What do the National Cybersecurity Authority controls say?

The Essential Cybersecurity Controls ECC-2:2024 issued by Saudi Arabia's National Cybersecurity Authority require multi-factor authentication in at least three places:

• Control 2-2-3-2: for remote access and for privileged accounts.
• Control 2-4-3-2: for remote and webmail access to email.
• Control 2-15-3-5: for users' access to external web applications.

The controls are binding on government agencies, their affiliated companies, and private sector entities that own, operate or host critical national infrastructure, and the Authority strongly encourages every other entity in the Kingdom to use them. If you supply services to a government entity, expect to be asked about them in vendor assessments.

Steps to switch it on this week

• Microsoft 365: in the Microsoft Entra admin center open Entra ID, then Overview, then Properties, then Manage security defaults, and enable them. Security defaults are free, need no extra licence, enforce two-factor authentication on administrators and block legacy protocols. Microsoft recommends two emergency admin accounts not tied to any one employee so you never lock yourself out.
• Google Workspace: under Menu, then Security, then Authentication, then 2-step verification, first allow staff to enrol, then enforce it from a set date. Google allows a new-user enrolment period of 1 day to 6 months, and you can require security keys or passkeys for management and finance.
• Priority: start with admin, finance and email accounts, then the rest of the staff, then other systems such as your accounting system, online store and hosting panels.
• Follow-up: ask for a weekly report of who has not enrolled, and make no exceptions except temporary ones with a written reason.

The Origami view

What changed is not the type of attack, since password guessing is old, but its cost: it is now automated, cheap and available to anyone. A business whose email and accounting system still open with a password alone is betting the attacker will never reach it, and that bet loses over time.

That is why every system Origami delivers is built so that sign-in passes through at least two factors, tied to single sign-on when the business already has a Microsoft or Google account, as we explained in our article on secure authentication and SSO. If you want the way your team signs in to your systems reviewed, or tied to one protected account, get in touch.

Conclusion

A free AI attack tool now tries thousands of passwords a minute without tiring. Two-factor authentication plus switching off legacy protocols closes most of that door, and it can be turned on in Microsoft 365 and Google within days at no extra cost. Start with management and finance today, and do not wait for your account to appear on the victim list in the next report.