Okta: agent-driven signups and probes hit hundreds of identity tenants
Agentic tooling made the attempts fast and broad rather than novel: Okta says it saw no identity-platform flaw exploited.
· Okta · Research by Grayson Schermerhorn (Okta Threat Intelligence), Okta Threat Intelligence
Okta Threat Intelligence reports reconnaissance, fraudulent signups and intrusion attempts across hundreds of Auth0 and Okta tenants. Okta assesses agentic frameworks, probably ARTEX, drove the rise through October 2026.
01What happened
Okta Threat Intelligence published an advisory on November 6, 2026 covering reconnaissance, fraudulent registration and intrusion attempts across hundreds of Auth0 and Okta tenants. The activity grew sharply during October and early November 2026, appearing first against cryptocurrency providers' customer identity tenants before spreading to other organizations. Okta assesses that multiple actors tasked agentic frameworks, probably ARTEX, with the work, but cannot confirm ARTEX in every case.
02How it works
The agents chained ordinary identity attacks at machine speed and scale. Okta reports OAuth redirect and scope testing, PKCE, DPoP and JWT signature checks, credential stuffing and password spraying routed through residential proxy pools so that per-IP lockouts never trigger. Where self-service sign-up is open, accounts were registered in bulk with disposable addresses from mail.tm, which issues them on maxxspace.com without an API key. One cluster aimed at crypto exchanges favored shared-mailbox names such as admin@, support@ and security@.
03Who is affected
Auth0 tenants using Universal Login and cross-origin authentication carry the most exposure, along with Okta Workforce Identity and Customer Identity tenants that allow self-service registration. Okta counted thousands of fraudulent accounts across several hundred such tenants. Okta adds that third parties reported similar activity against Amazon Cognito and Microsoft Entra.
04What to do
Disable or restrict self-service registration, block API signups where Universal Login signups are allowed, and block disposable email domains at registration. Move users to passkeys, disable the ROPC grant, block breached credentials and set ThreatInsight to enforce mode. Run CheckMate for Auth0 to find risky tenant settings, then delete fraudulent accounts and revoke their sessions and tokens.
Questions people ask
- Is my Auth0 tenant affected by the ARTEX identity reconnaissance?
- Auth0 tenants that allow self-service sign-up are the ones Okta saw affected most, because the agents registered accounts in bulk. Okta says it found no exploitation of Auth0-specific vulnerabilities, so exposure comes from tenant configuration rather than a platform flaw. Check whether Universal Login signups and API signups are both open, and review recent registrations for disposable email domains.
- Did Okta confirm any accounts were taken over?
- Okta reports no confirmed account takeover or data loss from the activity it observed, describing reconnaissance, fraudulent registration and intrusion attempts instead. Okta does warn that fraudulent accounts can enable later compromise in federated or linked environments, and it cites third-party reports of attackers reaching privileged access elsewhere that Okta did not observe directly.
- How does this differ from Microsoft's Storm-0940 ARTEX reporting?
- Microsoft's October 21 report attributes a supply chain compromise at ConnectWise to Storm-0940 using ARTEX. Okta's advisory covers identity-provider telemetry instead: fraudulent registration and credential attacks across Auth0 and Okta tenants, with infrastructure overlapping the ConnectWise and Microsoft reporting between October 9 and 23, 2026. Okta assesses Storm-0940 as one of several operators running ARTEX forks.
Sources 4 links, all fetched
- 1okta.comOkta Advisory
- 2microsoft.comMicrosoft On ARTEX
- 3wiz.ioWiz On ARTEX
- 4github.comAuth0 CheckMate