ARTEX AI agents steal Azure secrets from exposed GitHub credentials

Microsoft says ARTEX AI agents turn exposed GitHub credentials into Azure Key Vault and cloud data theft within minutes.

Microsoft Threat Intelligence says criminals and state-linked groups are using the ARTEX penetration-testing framework to find secrets in public GitHub code and sign in as Azure applications. High-volume searches began in August 2026; successful service-principal sign-ins were seen from October 28, including a compromised vendor multitenant app reaching downstream customers. One agent reached Azure Key Vault in five minutes, then mapped subscriptions, pulled secrets, and used Azure VM Run Command. Activity also touched Entra ID, Microsoft 365, SharePoint, and OneDrive. Todyl reports about 45 app registrations and access to 27 organizations; Microsoft named several source IP addresses.