Cloud Access in Under Three Hours: AI-Powered Cyberattacks Fuel Black October Fears

Automated attacks raise alarms

Cybersecurity developments in October 2026 have prompted some observers to call the period “Black October.” Security professionals are reportedly struggling to keep up as attackers use more automated tools and researchers identify weaknesses in widely used software. Microsoft Threat Intelligence said on Oct. 21 that Storm-0940, a China-state-aligned hacking group, used ARTEX, an open-source AI-powered penetration testing framework. The tool can automate tasks such as examining networks and finding possible weaknesses. Microsoft said the group targeted hundreds of organizations across several industries. Some attacks gained unauthorized privileged access to cloud systems in less than three hours.

Microsoft details login campaign

Microsoft recorded more than 151,000 failed login attempts from Oct. 10 to 14 in a campaign directed at 327 accounts across eight organizations. The activity peaked on Oct. 11, when attackers made about 2,900 failed attempts per minute.

The tactic, known as password spraying, tests passwords across multiple accounts in search of a successful login. Microsoft warned that suspicious account access alone does not establish that customer information was stolen, but said the activity shows how quickly attackers may act when they have usable credentials.

Unexpected charges expose risks

Colin Parsons, a startup founder, said he woke up to about 50 billing notifications he did not expect. He reported $281 in OpenAI charges and $168 involving Anthropic, totaling $449. The credentials were associated with OpenCode, an AI coding platform he used.

OpenCode said about 1.4% of its Console users who had connected outside AI providers were affected. The disclosure involved credentials stored in Console, not keys held locally in OpenCode’s desktop or command-line applications. Other users also described unexpected charges, but those amounts have not been independently verified.