Actors use ARTEX AI agents to turn GitHub secrets into Azure theft

Microsoft says ARTEX agents find exposed GitHub credentials and abuse Azure and Entra ID, sometimes within minutes.

Microsoft Threat Intelligence says threat actors are using the ARTEX agentic AI framework to search public GitHub repositories for application secrets and cloud or AI keys, then sign in with compromised Entra ID service principals. Follow-on activity includes cloud discovery, Azure Key Vault and Storage exfiltration, Azure AI services abuse, SharePoint and OneDrive downloads, and Azure VM Run Command. Microsoft says one chain reached Key Vault access in five minutes; a later report says a failed Key Vault call succeeded on retry in about 28 seconds. A November 9 account, citing Microsoft, says criminals and state-linked groups are involved, with successful sign-ins from October 28, including through a compromised vendor multitenant app.