# WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework

> WorkOS disclosed that on October 30, 2026 an attacker gained unauthorized access to an internal sales application, using the ARTEX AI offensive security framework to automate reconnaissance and exploitation attempts. Exposed data includes business contact details, account histories and sales/customer communication summaries; WorkOS states application data and production services were not affected.

- **Published:** 2026-11-03T21:56:09Z
- **Last reviewed:** 2026-11-03T21:56:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5179
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5179.png
- **ID:** TL-2026-5179
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below)

## Description

On October 30, 2026 WorkOS, an enterprise authentication/identity vendor serving roughly 3,000 companies (including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid and Netlify), identified unauthorized access to an internal sales application. WorkOS publicly disclosed the incident on November 3, 2026. According to the disclosure as reported by BleepingComputer, the attacker used ARTEX AI, described as an AI-powered offensive security framework used to automate reconnaissance and exploitation attempts. Web request logs contained the user agents 'artex-enrich/1.0' and 'norma/0.4'. The 'norma/0.4' user agent also appears in Wiz's independent analysis of ARTEX activity against IT and software vendors, which corroborates that it is an ARTEX-associated client string.

Exposed data is limited to the internal sales tooling: business contact details (names, email addresses, job titles, company names), customer account histories and product-usage information, and summaries of sales calls, support discussions and customer Slack conversations. WorkOS states that WorkOS application data and production services were not affected. The initial access vector and the specific vulnerability or credential weakness exploited have not been disclosed.

WorkOS response: external access to the affected application was disabled immediately, access controls on internal tools were reviewed, and an independent forensics firm was engaged; a fuller account is promised after the investigation. WorkOS will notify affected customers directly and warns of phishing and social-engineering risk using the exposed business context.

ARTEX background (from secondary reporting): ARTEX is an open-source autonomous, agentic LLM-driven penetration-testing framework published on GitHub in July 2026 by a Chinese developer, which won Baidu's 'Agent+' red team challenge in September 2026 and was made closed-source on October 8, 2026 after abuse (including against South Korean financial institutions); 12,000+ forks had accumulated and multiple forks remain public. It uses planner agents to select objectives and worker agents to run tools (nmap, curl, Impacket) around a shared graph of assets and findings. Wiz documents ARTEX-style behaviour against identity providers and software vendors: downloading JavaScript bundles and source maps, harvesting exposed runtime configuration and Swagger/OpenAPI documents, manipulating OAuth callbacks/state, testing unsigned 'alg: none' JWTs, generating 60+ SSO endpoint variants in two minutes, password spraying Okta/Entra ID at about one attempt per second in 20-60 minute bursts, abusing AWS Cognito sign-up/recovery APIs, tenant-isolation testing with disposable email accounts, and rotating IPs and user agents when blocked, with sessions lasting 24-30 hours. These behaviours were observed in other campaigns and are not confirmed for the WorkOS incident.

CrowdStrike reported that the China-nexus group 'Vapor Panda' used ARTEX against 200+ organizations in 14+ countries from October 17, 2026 (breaches confirmed at nine); Microsoft tracks separate ARTEX-assisted activity as Storm-0940; and Zscaler/others describe a distinct, apparently financially motivated Chinese-speaking operator in the South Korean bank intrusions. These are described as separate campaigns using the same tool. No source attributes the WorkOS incident to any of these actors; because ARTEX forks are public, tool use alone is not attribution.

## MITRE ATT&CK

- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1594 Search Victim-Owned Websites
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1110.003 Password Spraying
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX AI Offensive Framework User Agents in Web Logs (WorkOS Incident)** (`TL-2026-5179-SPL-001`)

Detects HTTP requests whose User-Agent is artex-enrich/1.0 or norma/0.4 (both seen in WorkOS web request logs during the 2026-10-30 internal sales app breach) or ReconProbe/1.0 (listed by Wiz for ARTEX activity against IT/software vendors). These are client strings of the agentic ARTEX AI pentest framework, used to automate reconnaissance and exploitation of public-facing web applications. Aggregates per source so analysts see request volume, path breadth and HTTP status mix. Presence of these strings shows adversary use of an obtained offensive tool (T1588.002) with AI-driven automation (T1588.007).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595, T1595.002, T1190, T1588.002, T1588.007
- **Data sources:** index=web sourcetype=access_combined, nginx:plus:access, aws:cloudfront:accesslogs, W3CIISLog, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:cloudfront:accesslogs OR sourcetype=aws:elb:accesslogs) earliest=-24h ("artex-enrich/1.0" OR "norma/0.4" OR "ReconProbe/1.0")
```TL-2026-5179 ARTEX AI user agents from WorkOS incident and Wiz reporting```
| eval artex_ua=case(like(_raw,"%artex-enrich/1.0%"),"artex-enrich/1.0", like(_raw,"%norma/0.4%"),"norma/0.4", like(_raw,"%ReconProbe/1.0%"),"ReconProbe/1.0")
| where isnotnull(artex_ua)
| eval src_ip=coalesce(src, clientip, c_ip), path=coalesce(uri_path, cs_uri_stem, uri)
| stats count AS requests dc(path) AS distinct_paths values(status) AS http_status min(_time) AS first_seen max(_time) AS last_seen BY src_ip, host, artex_ua
| convert ctime(first_seen) ctime(last_seen)
| sort - requests
````

### Microsoft KQL

```kql
union isfuzzy=true
    (W3CIISLog
    | where TimeGenerated > ago(24h)
    | where csUserAgent contains 'artex-enrich/1.0' or csUserAgent contains 'norma/0.4' or csUserAgent contains 'ReconProbe/1.0'
    | project TimeGenerated, Source='W3CIISLog', ClientIP=cIP, UserAgent=csUserAgent, Uri=csUriStem, Status=tostring(scStatus)),
    (CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestClientApplication contains 'artex-enrich/1.0' or RequestClientApplication contains 'norma/0.4' or RequestClientApplication contains 'ReconProbe/1.0'
    | project TimeGenerated, Source='CommonSecurityLog', ClientIP=SourceIP, UserAgent=RequestClientApplication, Uri=RequestURL, Status=tostring(EventOutcome))
| summarize Requests=count(), DistinctUris=dcount(Uri), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Statuses=make_set(Status, 10) by ClientIP, UserAgent, Source
| order by Requests desc
```

### Sigma

```yaml
title: ARTEX AI Offensive Framework User Agents in Web Requests
id: 7c3e1a52-4b9d-4f06-9a1e-5d2b8c7f3a41
status: experimental
description: Detects HTTP requests carrying the user agents artex-enrich/1.0, norma/0.4 or ReconProbe/1.0, client strings associated with the ARTEX AI agentic offensive framework (WorkOS internal sales app incident, TL-2026-5179).
references:
  - https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/
  - https://wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial-access
  - attack.t1190
  - attack.resource-development
  - attack.t1588.002
  - attack.t1588.007
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains:
      - 'artex-enrich/1.0'
      - 'norma/0.4'
      - 'ReconProbe/1.0'
  condition: selection
falsepositives:
  - Authorized red team or pentest engagement using an ARTEX fork with default client strings
  - Unrelated software that happens to reuse the norma/0.4 client string
level: high
```

**Known false positives:**

- Authorized penetration test or red-team exercise using an ARTEX fork with default client strings
- Unrelated internal tooling that reuses the generic norma/0.4 client string

**Tuning notes:** Point the index/sourcetype at your WAF, reverse-proxy or application access logs and map the client IP and path field names for your sourcetype. Add the user agent to a block list on the WAF once confirmed. ARTEX forks can change client strings, so pair this with the burst, rotation and recon-artifact detections. Exclude scanners from approved pentest windows via a lookup.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Automated SSO/Auth Endpoint Variant Burst (ARTEX-Style Enumeration) (locked: unlock with TL Creds)
- Non-Browser Client Retrieving Sales/CRM Records (locked: unlock with TL Creds)
- Entra ID Password Spray (Low-and-Slow Multi-Account Failures) (locked: unlock with TL Creds)
- Source Map, Swagger/OpenAPI and Runtime Config Harvesting (locked: unlock with TL Creds)
- Source Rotating User Agents After Blocked Requests (locked: unlock with TL Creds)
- Okta Password Spray From a Single IP (locked: unlock with TL Creds)
- Bulk Retrieval of Sales/CRM Records from Internal Application (locked: unlock with TL Creds)
- Traffic From Known ARTEX Campaign Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 14)

Defanged, TLP:CLEAR.

- IP address: `104.194.150[.]21`
- IP address: `144.172.64[.]60`
- IP address: `144.172.64[.]99`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [WorkOS says attacker used ARTEX AI to breach internal sales app](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/)
- [ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors](https://wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)
- [GMO Cybersecurity Links China-Built AI Tool ARTEX to Japan Breaches](https://letsdatascience.com/news/gmo-cybersecurity-links-china-built-ai-tool-artex-to-japan-b-91cc98b1)
- [AI-powered hacking goes global as Chinese groups use ARTEX to automate cyber espionage](https://www.cryptopolitan.com/ai-powered-hacking-goes-global-as-chinese-groups-use-artex-to-automate-cyber-espionage/)
- [CrowdStrike: How a Cyber Attacker hit South Korean Banks](https://cybermagazine.com/news/crowdstrike-on-south-korea-bank-ai-cyber-attack)
- [ARTEX South Korean bank attacks expose the risk of AI pentest agents](https://www.remio.ai/post/artex-south-korean-bank-attacks-expose-the-risk-of-ai-pentest-agents)
- [AI Incident Database - ARTEX developers entity](https://incidentdatabase.ai/entities/artex-developers/)
- [AI-powered attacks on South Korean financial sectors linked to Chinese DDoS group: report](https://asianews.network/?p=307184)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5179