After 151,000 failed logins bought nothing, the stolen ConnectWise keys let the AI walk in

Microsoft's timeline shows the pivot: between October 10 and 14, one Storm-0940 server racked up more than 151,000 failed sign-ins against 327 accounts at eight organizations — with zero successes. Then, on October 15, the attackers seized the identities of multiple ConnectWise cloud apps, and the AI agents authenticated straight into customer tenants with no user sign-in involved.