Threat actors use agentic AI tool ARTEX to hunt exposed secrets and abuse cloud access
AI SECURITYAzure Key Vaultredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Microsoft Threat Intelligence has seen threat actors using an agentic AI offensive framework, ARTEX, to scan public GitHub repositories for credentials, application secrets and AI API keys, then use them for follow-on attacks. In one case an agent moved from finding a secret to exfiltrating data from Azure Key Vault in five minutes. Follow-on activity from October 28, 2026 used leaked application credentials to access Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Assume any secrets found in public repositories are compromised.
- Rotate exposed keys and credentials immediately and remove them from the codebase.
- Scan GitHub repositories for secrets and enable public monitoring and push protection.
- Move OAuth applications away from secret-based authentication to managed identities.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Microsoft Security Blog
Who and what is in it
Companies