Agentic Identity Attacks: A Hardening Reference

Scope

This guide focuses on how autonomous penetration testing frameworks, specifically ARTEX, target and exploit customer and workforce identity flows. It applies to Auth0, Okta, and any OAuth 2.0 or OpenID Connect (OIDC) based identity provider. Similar activities have been reported against Amazon Cognito and Microsoft Entra by Wiz and Microsoft.

A key point is that Okta Threat Intelligence hasn't observed new exploitation methods. These agents use known misconfigurations and common attacks at high speed and scale. Your challenge isn't a new vulnerability; it's that every weak default in your system will be identified and tested within hours.

Key Concepts and Definitions

Agentic framework. A system that autonomously plans, executes, and adapts reconnaissance and exploitation with minimal human input. ARTEX is one such framework.

Storm-0940. Microsoft's label for a China state-aligned actor using ARTEX against hundreds of organizations between September and October 2026. Okta believes several operators are using a variant of ARTEX.

Probe account. A fraudulently registered account with an email address encoding its test purpose, such as i04probe1792451568@....

Resource Owner Password Credentials (ROPC) grant. An OAuth 2.0 grant type for migrating legacy systems, making it a target for credential stuffing.

Cross-origin authentication (Auth0). An Auth0 flow that exposes credential submission paths vulnerable to rate-limit probing.

Requirements Breakdown: What the Agents Test

Agent behavior falls into four categories. Treat each as a control requirement you must demonstrate.

Implementation Guidance

1. Remove the grants agents love

Disable ROPC wherever possible. Okta advises it's unsuitable for current threats. If Auth0 cross-origin authentication isn't necessary, turn it off. These flows are prime targets for credential stuffing and rate-limit probing.

2. Close the API signup bypass

Agents often register accounts via the Auth0 Authentication API, bypassing protections in Universal Login. If you allow signups through Universal Login, block API signups. Bot detection on a login page is ineffective if the attacker bypasses the page.

3. Block disposable email domains

Agents use disposable providers with keyless APIs, like mail[.]tm. Programmatic mailbox creation and reading mean email verification doesn't confirm a human presence. Use Auth0 Actions to block these domains at signup and detect any that slip through.

4. Reserve shared-mailbox prefixes

A common tactic against cryptocurrency exchanges is using shared-mailbox prefixes like admin@ or security@. These often resolve to real inboxes, and staff might accidentally click verification links. Block or manually review registrations using your domain, especially these prefixes.

5. Watch account linking and federation

Fraudulent accounts are particularly concerning in identity federation, account linking, or mixed-use cases. A pre-registered attacker account can be a staging point for takeover. Monitor account linking events and flag links involving new accounts.

6. Make passwords the exception

Adopt phishing-resistant authentication like passkeys (FIDO2). Where passwords remain, block logins using breached credentials. Distributed spraying across residential proxies defeats per-IP lockout, so focus on account and credential controls.

7. Audit before the agents do

Use the open source CheckMate for Auth0 tool on your tenants. It maps recommendations to the attacker behaviors described here. Detections are also in the Auth0 detection catalog on GitHub.

8. Clean up fast

When you find fraudulent accounts, delete them, revoke sessions and tokens, and remove attacker-enrolled factors. Use the probe-account naming pattern and creation timestamps to find clusters.

Common Pitfalls

• Treating client IDs as secrets. Agents scrape valid client_id and redirect_uri pairs from public sign-in pages. Design as if both are known.
• Hardening the UI, not the API. Controls in Universal Login leave direct API signup open.
• Relying on email verification as proof of humanity. Disposable mailbox APIs can satisfy it programmatically.
• Per-IP lockout as your only throttle. Residential proxy pools are designed to defeat it.
• Ignoring dormant fraudulent accounts. They become risky once federation or account linking is in play.
• Leaving legacy grants enabled "just in case." If nothing legitimate uses ROPC, disable it.
• Overlooking third-party secrets. Storm-0940's attack on Entra customers involved compromised secrets from ConnectWise. Inventory and rotate secrets in your integrations.

Quick Reference Table

Okta noted a significant increase in activity in October and early November 2026. Review your logs for that period first.