Microsoft says attackers are using an AI agent framework called ARTEX to search public GitHub repositories for exposed credentials and then use them to get into Azure and Microsoft 365 resources. In one case Microsoft observed, an AI agent went from searching GitHub for client secrets to taking data out of an Azure Key Vault in five minutes.
The findings come from a Microsoft Threat Intelligence and Microsoft Security Research report published November 5. Microsoft does not name who is behind the activity.
What Microsoft saw
Searching public code for exposed keys is an old technique. Microsoft says what has changed is speed. Human attackers used to spend time finding repositories, reviewing what was in them and using what they found. In the report's words, "agentic tooling like ARTEX allows threat actors to not only scan for secrets across multiple repositories at a quicker pace but also use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain."
Microsoft says it first observed the GitHub scanning in August 2026. The framework sent large volumes of queries to GitHub. The queries often combined the name of a target organization, a keyword for secrets, a keyword for a cloud service, or a keyword for another AI service provider.
Starting as early as October 28, Microsoft saw successful sign-ins to Entra ID tenants using valid exposed or stolen application credentials. The sign-ins came mainly from two IP addresses, one of which Microsoft says is a Tor exit node. The agent signed in as service principals, the identities that applications use, on dozens of applications across multiple tenants. In some cases, a credential for a multitenant app was compromised at the vendor and then used to reach several downstream tenants.
Once inside, Microsoft says the attackers went after operations that return more credentials: storage account keys, App Service settings, connection strings, publishing credentials, AI and machine learning connections, and Azure Kubernetes Service user credentials. The compromised apps downloaded files from SharePoint and OneDrive, accessed mailbox items, in some tenants ran Microsoft Graph searches, and mapped subscriptions, permissions and AI model deployments. The agents also used Run Command, which runs scripts on Azure virtual machines.
The agent fixed its own mistakes
The report's most specific detail is how the tool recovered from errors. Microsoft lists three cases where a cloud API request failed with HTTP 400 and was then retried with a corrected API version or method:
- A batch of Key Vault requests failed because it used a data-plane API version against the control plane. About 28 seconds after the first failure, a rerun using ARM API version 2023-07-01 returned HTTP 200.
- A request for an Azure SQL server's firewall rules used an outdated API version. About 60 seconds later, the same request with a supported version succeeded. Only the api-version parameter changed.
- An Application Insights query failed on an outdated version and succeeded about 80 seconds later with a supported one.
Microsoft says these sequences are consistent with "adaptive troubleshooting." Each corrected retry began about 28 to 80 seconds after the failed request.
Why AI keys were a target
Microsoft says the agents "repeatedly demonstrated a focus on credentials that provide access to AI services," including API keys for major AI providers and OAuth apps with access to Foundry Tools, formerly Azure Cognitive Services. The report adds that multiple public reports have documented attackers using agentic tools to compromise AI service credentials, "sometimes to run the same agentic AI workflow." Microsoft also says the attackers tried to validate stolen Azure AI resources and "might have attempted to abuse" some of them in the wider attack.
That matters for any team that has pasted an AI API key into a script or config file. We covered a related exposure path in our report on how a Claude Code setting exposed secrets to GitHub.
Links to other campaigns
Microsoft also saw malicious activity from two IP addresses it says are potentially associated with this campaign. Activity from one included indications of vulnerability exploitation through shell commands embedded in a user agent, and attempts to obtain App Service authentication tokens. Microsoft says Todyl reported a similar campaign involving the same IPs.
Cybersecurity Dive reports that ARTEX has traditionally been used for penetration testing, and that it was previously used by a China-nexus actor, tracked as Storm-0940, to abuse ConnectWise Cloud Backup. The outlet says it is not clear who is behind the GitHub scanning.
What Microsoft tells defenders
Microsoft's core advice is that an exposed secret stays dangerous until it is rotated. "Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure," the report says. Organizations that find secrets in a public repository "must assume that the exposed secrets and associated applications are compromised."
Its recommendations include:
- Scan repositories for secrets and rotate anything exposed right away.
- Move apps from client secrets to managed identities where possible.
- Apply Conditional Access policies to workload identities and limit service principal permissions.
- Review Entra sign-in logs for the IP addresses Microsoft lists. Microsoft says a failed sign-in with an invalid or expired secret followed by a success "is urgent."
- Watch for behavior, not only IPs: one address authenticating to three or more service principals with mixed success, or one app requesting tokens across Azure Resource Manager, Key Vault, Storage and Microsoft Graph in a short window.
Microsoft notes that attackers can change IP addresses, user agents and other fingerprints. By default, it says, ARTEX uses tools such as Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright, which may leave default user agent strings. It also recommends honeypots, tarpits and "fake wins" that make an agent believe its goal is done. Microsoft says these controls helped reduce attack traffic reaching real assets in its testing.
For context on how quickly offensive AI is improving, see our posts on GPT-6 Cyber and DeepSeek's results in a Vals hacking test.
