Machine‑speed attacks: what small businesses should know

This story is developing and details may change. Last checked 25 Oct 2026.

What happened

Reported by Storm-0940 uses ARTEX agentic AI to accelerate activity to machine speed (Microsoft Security Blog) on 21 Oct 2026. The event itself dates from 21 Oct 2026.

Recent vendor and industry reporting describes intrusions that operate at 'machine speed'. Attackers use stolen developer tokens, compromised credentials, malicious install commands and social engineering to enumerate accounts and pull data within minutes of gaining access. One report describes a stolen GitHub OAuth token used to download hundreds of repositories in seconds despite detection within five minutes. A Microsoft advisory documents an AI‑augmented campaign that drove extremely high request volumes and rapid cross‑tenant activity. These accounts are drawn from cloud, SaaS, code repositories and developer endpoints. (Claims: 1, 2, 3, 4) 1 2

Why it matters to small businesses

For small businesses the core issue is speed. Attackers can now find and take data far faster than traditional manual detection and response workflows allow. That means a breach can produce significant exposure before people notice. Common causes highlighted include stolen developer tokens, malicious installers that drop stealers and social‑engineering that defeats MFA prompts. Industry guidance is shifting toward behavioural and identity‑linked detection and to low‑friction automated responses such as revoking sessions or disabling tokens so defenders can act at machine speed. These changes affect how you protect developer tools, API keys, account sessions and onboarding of new software. (Claims: 1, 2, 3, 4, 5) 1 2

TabSphere's view

This section is TabSphere's interpretation, not reported fact.

Interpretation: small businesses may already be exposed through routine developer habits and software installs. Protecting websites, e‑commerce platforms and bespoke apps is not just about patching servers. It also means watching how identities, tokens and sessions are used and building simple, fast containment steps. You do not need enterprise tooling overnight. You do need tighter controls on secrets, clearer install processes, and fast ways to revoke access when something looks odd.

What to do next

• Inventory developer tokens and secrets. Locate OAuth tokens, API keys and other developer secrets used by your projects and list where they are stored. Remove any hardcoded secrets from code and move them to a managed secrets store or environment variables. Make token lifetimes short where practical.
• Tighten installs and tool onboarding. Treat new developer tools and AI plugins with caution. Require an approved process for installs, document who authorised each tool and avoid running unverified install commands on production or developer machines.
• Make session and credential revocation easy. Ensure account sessions, tokens and API keys can be quickly revoked. Keep a clear procedure so a colleague can revoke a compromised token or sign‑out a user promptly if you suspect misuse.
• Monitor for unusual identity and endpoint behaviour. Look for spikes in sign‑ins, rapid repository downloads, cross‑tenant activity or unusual CLI commands. Link identity signals with endpoint alerts so odd combinations trigger investigation, even if each signal by itself looks small.
• Review MFA and approval flows. Educate staff about push‑approval fatigue and vishing. Use MFA methods that resist approval prompts where possible and require additional verification for sensitive operations.

Sensible precautions

• Do not store long‑lived tokens in public repositories or shared documents.
• Avoid approving unexpected MFA prompts; verify with the requester by a separate channel.
• Limit developer machine access to only what’s needed for their role.

What isn't known yet

• Attribution of these incidents to any specific actor or single group is not established by the sources and remains unverified. (Claim: 6)

These incidents show attackers can act very fast. Small businesses can reduce exposure by tightening how developers use tokens and tools, by making it simple to revoke access, and by linking identity and endpoint signals so odd behaviour is noticed sooner. Practical steps taken now make a real difference without big programmes or claims of perfect security.

If you want to review how your website, e‑commerce setup or bespoke software handles tokens and sessions, get in touch and we can talk it through.

Sources

Checked 25 Oct 2026.

• Machine speed attacks require machine speed detection and response (published 22 Oct 2026)
• Storm-0940 uses ARTEX agentic AI to accelerate activity to machine speed (Microsoft Security Blog) (published 21 Oct 2026)