Azure Key Vault

Threat actors use agentic AI tool ARTEX to hunt exposed secrets and abuse cloud access

Microsoft◼ Threat Intelligence has seen threat actors using an agentic AI offensive framework, ARTEX, to scan public GitHub repositories for credentials, application secrets and AI API keys, then use them for follow-on attacks. In one case an agent moved from finding a secret to exfiltrating data from Azure Key Vault◆ in five minutes. Follow-on activity from October 28, 2026 used leaked application credentials to access Microsoft Entra ID◆ tenants and connected Azure and Microsoft 365 resources.