WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework

Key facts for ARTEX AI WorkOS breach

Detection coverage for ARTEX AI WorkOS breach

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5179 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX AI Offensive Framework User Agents in Web Logs (WorkOS Incident)

Detects HTTP requests whose User-Agent is artex-enrich/1.0 or norma/0.4 (both seen in WorkOS web request logs during the 2026-10-30 internal sales app breach) or ReconProbe/1.0 (listed by Wiz for ARTEX activity against IT/software vendors). These are client strings of the agentic ARTEX AI pentest framework, used to automate reconnaissance and exploitation of public-facing web applications. Aggregates per source so analysts see request volume, path breadth and HTTP status mix. Presence of these strings shows adversary use of an obtained offensive tool (T1588.002) with AI-driven automation (T1588.007).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1595, T1595.002, T1190, T1588.002, T1588.007
• Data sources: index=web sourcetype=access_combined, nginx:plus:access, aws:cloudfront:accesslogs, W3CIISLog, CommonSecurityLog
• Severity: high
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:cloudfront:accesslogs OR sourcetype=aws:elb:accesslogs) earliest=-24h ("artex-enrich/1.0" OR "norma/0.4" OR "ReconProbe/1.0")
```TL-2026-5179 ARTEX AI user agents from WorkOS incident and Wiz reporting```
| eval artex_ua=case(like(_raw,"%artex-enrich/1.0%"),"artex-enrich/1.0", like(_raw,"%norma/0.4%"),"norma/0.4", like(_raw,"%ReconProbe/1.0%"),"ReconProbe/1.0")
| where isnotnull(artex_ua)
| eval src_ip=coalesce(src, clientip, c_ip), path=coalesce(uri_path, cs_uri_stem, uri)
| stats count AS requests dc(path) AS distinct_paths values(status) AS http_status min(_time) AS first_seen max(_time) AS last_seen BY src_ip, host, artex_ua
| convert ctime(first_seen) ctime(last_seen)
| sort - requests

Microsoft KQL

union isfuzzy=true
    (W3CIISLog
    | where TimeGenerated > ago(24h)
    | where csUserAgent contains 'artex-enrich/1.0' or csUserAgent contains 'norma/0.4' or csUserAgent contains 'ReconProbe/1.0'
    | project TimeGenerated, Source='W3CIISLog', ClientIP=cIP, UserAgent=csUserAgent, Uri=csUriStem, Status=tostring(scStatus)),
    (CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestClientApplication contains 'artex-enrich/1.0' or RequestClientApplication contains 'norma/0.4' or RequestClientApplication contains 'ReconProbe/1.0'
    | project TimeGenerated, Source='CommonSecurityLog', ClientIP=SourceIP, UserAgent=RequestClientApplication, Uri=RequestURL, Status=tostring(EventOutcome))
| summarize Requests=count(), DistinctUris=dcount(Uri), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Statuses=make_set(Status, 10) by ClientIP, UserAgent, Source
| order by Requests desc

Sigma

title: ARTEX AI Offensive Framework User Agents in Web Requests
id: 7c3e1a52-4b9d-4f06-9a1e-5d2b8c7f3a41
status: experimental
description: Detects HTTP requests carrying the user agents artex-enrich/1.0, norma/0.4 or ReconProbe/1.0, client strings associated with the ARTEX AI agentic offensive framework (WorkOS internal sales app incident, TL-2026-5179).
references:
  - https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/
  - https://wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial-access
  - attack.t1190
  - attack.resource-development
  - attack.t1588.002
  - attack.t1588.007
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains:
      - 'artex-enrich/1.0'
      - 'norma/0.4'
      - 'ReconProbe/1.0'
  condition: selection
falsepositives:
  - Authorized red team or pentest engagement using an ARTEX fork with default client strings
  - Unrelated software that happens to reuse the norma/0.4 client string
level: high

Known false positives:

• Authorized penetration test or red-team exercise using an ARTEX fork with default client strings
• Unrelated internal tooling that reuses the generic norma/0.4 client string

Tuning notes: Point the index/sourcetype at your WAF, reverse-proxy or application access logs and map the client IP and path field names for your sourcetype. Add the user agent to a block list on the WAF once confirmed. ARTEX forks can change client strings, so pair this with the burst, rotation and recon-artifact detections. Exclude scanners from approved pentest windows via a lookup.

• 🔒 Automated SSO/Auth Endpoint Variant Burst (ARTEX-Style Enumeration) · unlock with TL Creds
• 🔒 Non-Browser Client Retrieving Sales/CRM Records · unlock with TL Creds
• 🔒 Entra ID Password Spray (Low-and-Slow Multi-Account Failures) · unlock with TL Creds
• 🔒 Source Map, Swagger/OpenAPI and Runtime Config Harvesting · unlock with TL Creds
• 🔒 Source Rotating User Agents After Blocked Requests · unlock with TL Creds
• 🔒 Okta Password Spray From a Single IP · unlock with TL Creds
• 🔒 Bulk Retrieval of Sales/CRM Records from Internal Application · unlock with TL Creds
• 🔒 Traffic From Known ARTEX Campaign Infrastructure · unlock with TL Creds

Indicators of compromise for ARTEX AI WorkOS breach

As of 2026-11-03, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5179.

Sample indicators (3 of 14)

• IP address: 104.194.150[.]21
• IP address: 144.172.64[.]60
• IP address: 144.172.64[.]99

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

How ARTEX AI WorkOS breach works

On October 30, 2026 WorkOS, an enterprise authentication/identity vendor serving roughly 3,000 companies (including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid and Netlify), identified unauthorized access to an internal sales application. WorkOS publicly disclosed the incident on November 3, 2026. According to the disclosure as reported by BleepingComputer, the attacker used ARTEX AI, described as an AI-powered offensive security framework used to automate reconnaissance and exploitation attempts. Web request logs contained the user agents 'artex-enrich/1.0' and 'norma/0.4'. The 'norma/0.4' user agent also appears in Wiz's independent analysis of ARTEX activity against IT and software vendors, which corroborates that it is an ARTEX-associated client string.

Exposed data is limited to the internal sales tooling: business contact details (names, email addresses, job titles, company names), customer account histories and product-usage information, and summaries of sales calls, support discussions and customer Slack conversations. WorkOS states that WorkOS application data and production services were not affected. The initial access vector and the specific vulnerability or credential weakness exploited have not been disclosed.

WorkOS response: external access to the affected application was disabled immediately, access controls on internal tools were reviewed, and an independent forensics firm was engaged; a fuller account is promised after the investigation. WorkOS will notify affected customers directly and warns of phishing and social-engineering risk using the exposed business context.

ARTEX background (from secondary reporting): ARTEX is an open-source autonomous, agentic LLM-driven penetration-testing framework published on GitHub in July 2026 by a Chinese developer, which won Baidu's 'Agent+' red team challenge in September 2026 and was made closed-source on October 8, 2026 after abuse (including against South Korean financial institutions); 12,000+ forks had accumulated and multiple forks remain public. It uses planner agents to select objectives and worker agents to run tools (nmap, curl, Impacket) around a shared graph of assets and findings. Wiz documents ARTEX-style behaviour against identity providers and software vendors: downloading JavaScript bundles and source maps, harvesting exposed runtime configuration and Swagger/OpenAPI documents, manipulating OAuth callbacks/state, testing unsigned 'alg: none' JWTs, generating 60+ SSO endpoint variants in two minutes, password spraying Okta/Entra ID at about one attempt per second in 20-60 minute bursts, abusing AWS Cognito sign-up/recovery APIs, tenant-isolation testing with disposable email accounts, and rotating IPs and user agents when blocked, with sessions lasting 24-30 hours. These behaviours were observed in other campaigns and are not confirmed for the WorkOS incident.

CrowdStrike reported that the China-nexus group 'Vapor Panda' used ARTEX against 200+ organizations in 14+ countries from October 17, 2026 (breaches confirmed at nine); Microsoft tracks separate ARTEX-assisted activity as Storm-0940; and Zscaler/others describe a distinct, apparently financially motivated Chinese-speaking operator in the South Korean bank intrusions. These are described as separate campaigns using the same tool. No source attributes the WorkOS incident to any of these actors; because ARTEX forks are public, tool use alone is not attribution.

MITRE ATT&CK techniques by tactic:

Credential Access

T1110 Brute Force; T1110.003 Password Spraying

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Resource Development

T1588.002 Tool; T1588.007 Artificial Intelligence

Reconnaissance

T1594 Search Victim-Owned Websites; T1595 Active Scanning; T1595.002 Vulnerability Scanning

Remediation for ARTEX AI WorkOS breach

Patches

• No CVE or vendor patch published; WorkOS reports forensic investigation ongoing

Immediate actions

• Hunt web/proxy/WAF logs for the user agents 'artex-enrich/1.0', 'norma/0.4' and 'ReconProbe/1.0' and block or alert on them
• Treat customer-facing business contacts as phishing targets: alert staff to WorkOS-themed social engineering using real sales-call and account context
• Review and restrict external exposure of internal sales/CRM tooling; require SSO and MFA and IP allow-listing
• Review integrations that feed call summaries and Slack conversation summaries into sales apps for over-broad data retention
• Hunt for password-spray patterns (about 1 attempt/second bursts across many accounts) against Okta, Entra ID and Cognito tenants

Workarounds

• Disable or place behind a zero-trust proxy any internally intended application reachable from the internet
• Customers of WorkOS: verify the authenticity of any WorkOS communication through known channels before acting on it

Longer-term hardening

• Deploy rate-limit, bot-management and anomaly detection tuned for high-volume automated, LLM-driven probing of web applications
• Minimize sensitive customer content stored in internal sales tooling and enforce retention limits
• Add detection for non-browser or unusual user agents against internal applications
• Reject unsigned JWTs (alg: none), validate OAuth state/callback parameters, and strip source maps and Swagger/OpenAPI docs from production
• Perform regular external attack-surface and authorization testing of internal business apps

Affected and fixed versions

• WorkOS — Internal sales application (not a customer-facing product)
  Vulnerable versions: Not disclosed
  Fixed in: External access disabled; investigation ongoing

Timeline of ARTEX AI WorkOS breach

• 2026-07-01 Per Wiz, ARTEX is first published on GitHub by a Chinese developer as an open-source autonomous penetration-testing framework (month-level date; accumulates 12,000+ forks).
• 2026-10-08 ARTEX source is made closed-source following abuse against South Korean banks and others; public forks remain available.
• 2026-10-10 Per secondary reporting, ARTEX-assisted activity tracked by Microsoft as locked-ioc-10 includes 151,000+ failed logins against 327 accounts at 8 companies between Oct 10 and Oct 14 (separate campaign, not linked to WorkOS).
• 2026-10-17 CrowdStrike reports the China-nexus group locked-ioc-9 began using ARTEX against 200+ organizations in 14+ countries from this date; breaches confirmed at nine (separate campaign; no attribution of the WorkOS incident).
• 2026-10-20 GMO Cybersecurity reporting (Oct 19-20) links ARTEX to breaches of roughly 20 Japanese companies via six AI-enabled attack servers, showing broad abuse of the tool.
• 2026-10-21 Microsoft publishes a report linking ARTEX-assisted activity against IT and software vendors to locked-ioc-10.
• 2026-10-22 Wiz publishes 'ARTEX in the Wild', documenting ARTEX tooling behaviour, IPs and user agents (including norma/0.4) used against IT and software vendors.
• 2026-10-30 WorkOS identifies unauthorized access to an internal sales application by an attacker using locked-ioc-11; user agents 'artex-enrich/1.0' and 'norma/0.4' appear in web request logs.
• 2026-11-03 WorkOS publicly discloses the incident; external access to the application was disabled, internal tool access controls reviewed and an independent forensics firm engaged. BleepingComputer reports the disclosure.

Sources cited for ARTEX AI WorkOS breach

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors Wiz · Research · 2026-10-22
• AI Incident Database - ARTEX developers entity incidentdatabase.ai · Research
• ARTEX South Korean bank attacks expose the risk of AI pentest agents remio.ai · Blog
• WorkOS says attacker used ARTEX AI to breach internal sales app BleepingComputer · News · 2026-11-03
• GMO Cybersecurity Links China-Built AI Tool ARTEX to Japan Breaches letsdatascience.com · News · 2026-10-20
• AI-powered hacking goes global as Chinese groups use ARTEX to automate cyber espionage cryptopolitan.com · News
• CrowdStrike: How a Cyber Attacker hit South Korean Banks cybermagazine.com · News
• AI-powered attacks on South Korean financial sectors linked to Chinese DDoS group: report asianews.network · News

More in data breach

• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals
• Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk
• Moldova Government Systems Cyberattack Exploiting Unauthenticated Services, ~750,000 ID Records Accessed (Oct 19-23, 2026)