Dasturchilar platformasi WorkOS ma'lumotlar buzilishi sodir bo'lganini e'lon qildi, chunki tahdid aktori biznes aloqa yozuvlari va mijozlar bilan muloqot xulosalariga kirish huquqiga ega bo'ldi.
Kompaniyaning ma'lumotiga ko'ra, hujumchi razvedka va ekspluatatsiya urinishlarini avtomatlashtirish uchun AI hujum xavfsizlik tizimidan foydalangan.
Tergov dalillariga asoslanib, hech qanday WorkOS ilova ma'lumotlari yoki ishlab chiqarish xizmatlari kirilmagan yoki ta'sirlanmagan.
WorkOS — bu dasturchilar infratuzilmasi kompaniyasi bo'lib, u korporativ autentifikatsiya, yagona kirish (SSO), foydalanuvchilarni boshqarish va identifikatsiyani boshqarish kabi xizmatlarni ilovalarga integratsiya qilish uchun API, SDK va vositalarni taqdim etadi.
Uning veb-saytiga ko'ra, kamida 3000 ta kompaniya uning xizmatlaridan foydalanadi, jumladan OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow va Netlify.
"2026-yil 30-oktabrda biz savdo jamoamiz tomonidan ishlatiladigan ichki WorkOS ilovasiga ruxsatsiz kirishni aniqladik", — deb aytadi kompaniya hodisa haqida ogohlantirishda.
Hujumchi tomonidan kirilgan ma'lumotlar quyidagilarni o'z ichiga oladi:
- Biznes aloqa tafsilotlari (CRM tizimlaridan olingan ismlar, elektron pochta manzillari, lavozimlar va kompaniya aloqalari)
- Mijoz hisoblari tarixi (mahsulotdan foydalanish va ulanish yoki katalog salomatligi)
- Mijozlar bilan muloqot (savdo qo'ng'iroqlari, qo'llab-quvvatlash muhokamalari va mijoz Slack suhbatlaridan xulosalar va parchalar)
- Biznes hisob va munosabatlar ma'lumotlari (hisob tarixi, savdo va mijoz munosabatlari haqida ma'lumot)
Buzilishni aniqlagandan so'ng, WorkOS ta'sirlangan ilovaga tashqi kirishni o'chirib qo'ydi va ichki vositalarga kirish nazoratini ko'rib chiqdi.
Kompaniya shuningdek, ruxsatsiz faoliyatni kuzatish va uning to'liq ta'sirini aniqlash uchun mustaqil sud-tibbiyot va hodisaga javob berish firmasini yolladi.
Kompaniya ta'sirlangan mijozlarga to'g'ridan-to'g'ri xabar berishni va'da qildi va foydalanuvchilarni ochilgan ma'lumotlardan foydalanib amalga oshirilishi mumkin bo'lgan fishing yoki ijtimoiy muhandislik urinishlariga nisbatan hushyor bo'lishga chaqirdi.
ARTEX AI ehtimol hujumni quvvatlagan
WorkOS e'lonida hujum razvedka va ekspluatatsiya urinishlarini avtomatlashtirish uchun AI quvvatli hujum xavfsizlik tizimidan foydalanganligi aytiladi.
Kompaniya asoschisi Maykl Grinich ko'proq tafsilotlar bilan bo'lishdi va hujumchi bu yil bir nechta hodisalarda kuzatilgan ARTEX AI penetratsiya sinov to'plamidan foydalanganini aytdi.
Bu yil boshida xitoylik dasturchilar tomonidan chiqarilgan platforma hujum xavfsizligi uchun ochiq manbali loyiha sifatida mavjud edi.
ARTEX AI Janubiy Koreya banklariga qaratilgan hujumlarda ishlatilgandan so'ng shaxsiy bo'ldi, lekin uning kodining bir nechta forklar hali ham mavjud.
Yaqinda CrowdStrike "Vapor Panda" kiber-josuslik guruhi 200 ta tashkilotni nishonga olgan global kampaniyada penetratsiya sinov tizimidan foydalanganini ochib berdi.
Avvalroq, notijorat kiberxavfsizlik tashkiloti DIVD ham o'tgan sentyabrda o'zi duch kelgan hujumlarni aynan shu tizim quvvatlaganini e'lon qilgan edi.
Grinich tergov jamoasi tahdid aktorining veb-so'rovlarida 'artex-enrich/1.0' va 'norma/0.4' kabi foydalanuvchi agentlarini aniqlaganini tushuntirdi.
Asoschi kiberxavfsizlik hodisasi hozir to'liq nazorat ostiga olinganini va tergov tugagandan so'ng hujum haqida ko'proq ma'lumot ulashishni va'da qildi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace uchun 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.
According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts.
Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.
WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications.
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
“On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert.
Data accessed by the attacker includes:
- Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)
- Customer account histories (product usage and connection or directory health)
- Customer communications (summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
- Business account and relationship information (account histories, information about sales and customer relationship)
After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed its access controls on internal tools.
The company also contracted an independent forensics and incident response firm to track the unauthorized activity and determine its full impact.
The company promised to notify affected customers directly, and warned its users to remain vigilant for phishing or social engineering attempts leveraging the exposed information.
ARTEX AI likely powering the attack
WorkOS’s announcement says the attack used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts.
Company founder Michael Grinich shared more details, saying that the attacker used the ARTEX AI penetration testing suite that has been observed in multiple incidents this year.
Released earlier this year by Chinese developers, the platform was available as an open-source project for offensive security.
ARTEX AI became private after it was used in attacks targeting South Korean banks, but several forks of its code are still available.
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
Previously, the non-profit cybersecurity organization DIVD also revealed that the same framework powered the attacks it suffered last September.
Grinich explained that the investigating team identified user agents such as ‘artex-enrich/1.0’ and ‘norma/0.4’ in web requests from the threat actor.
The founder assured that the cybersecurity incident has now been fully contained and promised to share more information about the attack after the investigation completes.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.