“Armed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants.”
One vendor’s credentials became a master key to 2,250 organizations. Some attacks went from first contact to privileged cloud access in under three hours. Microsoft will tell you how many tenants were targeted but not how many fell. That gap is the real number, and nobody wants to say it.