Threat actors use agentic AI tool ARTEX to hunt exposed secrets and abuse cloud access
AI SECURITYAzure Key Vaultredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Criminals are using AI-driven tools to search public code sites such as GitHub for passwords and access keys that developers have accidentally left in their code. Microsoft says these tools can then use the keys to get into cloud accounts and copy data, in one case within five minutes. Anyone whose secrets have been exposed should treat them as stolen and replace them.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Assume any secrets found in public repositories are compromised.
- Rotate exposed keys and credentials immediately and remove them from the codebase.
- Scan GitHub repositories for secrets and enable public monitoring and push protection.
- Move OAuth applications away from secret-based authentication to managed identities.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Microsoft Security Blog
Who and what is in it
Companies