Hackers Use ARTEX AI to Steal Azure Data
Original title: Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes
Microsoft Threat Intelligence observed ARTEX AI agents automating GitHub secret discovery and Azure Key Vault theft in five minutes.
Microsoft identified ARTEX AI framework agents scanning GitHub repositories for exposed credentials. Agents then abused them to access Azure Key Vault, Entra ID, and connected resources. Attack chain mapped subscriptions, permissions, and storage keys using legitimate Azure tools.
- Agents extracted Azure Key Vault secrets.
- Accessed Microsoft 365 and SharePoint.
- Used Azure VM Run Command for execution.
- Targeted service principals across tenants.
Impact: Cloud credential abuse via exposed GitHub secrets
| Product | Affected |
|---|---|
| Microsoft Azure Key Vault | — |
- 1.Revoke and rotate exposed credentials
- 2.Disable compromised service principals
- 3.Enable GitHub secret scanning
- Vendors
- Microsoft
- Products
- AzureGitHubAzure Key Vault
- Malware
- ARTEX AI
- Organizations
- Microsoft Threat Intelligence
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 157.22.126.128 | ssociated malicious operations; App Service token attempts. 157.22.126[.]128 IPv4 Separately observed reconnaissance targeting victims |
| ipv4 | 199.19.77.18 | application sign-ins; cloud discovery and credential abuse. 199.19.77[.]18 IPv4 Sign-in source; Tor exit node potentially carrying u |
| ipv4 | 199.19.77.84 | compromise (IoCs):- Indicator Type Source-reported context 199.19.77[.]84 IPv4 Successful application sign-ins; cloud discovery and |
| ipv4 | 65.87.223.26 | rce; Tor exit node potentially carrying unrelated activity. 65.87.223[.]26 IPv4 Potentially associated malicious operations; App Ser |
From the original article
3 min read at cybersecuritynews.com
Hackers are using the ARTEX AI framework to find exposed credentials on GitHub and turn them into access to cloud systems. In one observed case, an AI agent moved from searching public repositories for application secrets to stealing data from Azure Key Vault in just five minutes, showing how quickly a coding mistake can become […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.