Microsoft exposes ARTEX attack automation that turned public GitHub secrets into access to Azure cloud resources. In one observed case, an AI agent moved from finding a client secret to exfiltrating Azure Key Vault data in five minutes.

The November 5 threat-intelligence report describes attackers using valid application credentials rather than exploiting a new Microsoft vulnerability. The speed matters because a leaked secret can now be discovered, tested and used across cloud services before a conventional incident queue reaches a human analyst.

The reported ARTEX campaign followed four recurring steps:

• Search public GitHub repositories for exposed credentials.
• Authenticate as service principals or OAuth applications.
• Map Azure, Microsoft 365 and AI resources.
• Collect more credentials and sensitive cloud data.

Microsoft Exposes ARTEX Attack From GitHub to Azure

Microsoft Threat Intelligence says it began seeing agentic tools submit large volumes of GitHub searches in August 2026. Queries combined organization names with terms associated with secrets, cloud platforms and AI services.

The framework did more than identify exposed strings. Microsoft observed it analyze results, authenticate with usable credentials and continue into connected systems with limited hands-on direction. The five-minute Key Vault case shows how quickly discovery can become data access.

Successful service-principal sign-ins appeared as early as October 28 from an address involved across multiple applications and customers. Microsoft says some incidents included a vendor-owned multitenant application credential, giving one compromised identity a route into downstream tenants.

Observed targets included Azure Key Vaults, Storage Accounts, SharePoint, OneDrive and Azure DevOps. The attackers also enumerated subscriptions, permissions, AI model deployments and service configurations, while seeking keys for major AI providers and Microsoft’s cloud AI services.

Stolen Service Principals Bypass User-Focused Defenses

Service principals are application identities, so a valid client secret can produce programmatic access without a user entering a password or approving a multifactor prompt. User-scoped conditional-access rules may therefore miss the login even when they protect employee accounts correctly.

Microsoft recorded the agent adapting after failed cloud requests. It changed incorrect API versions or methods and retried between 28 and 80 seconds later, receiving successful responses. That pattern is consistent with automated troubleshooting rather than a fixed scanner sending the same request repeatedly.

Todyl’s independent investigation reported that scripted clients generated 95% of sign-ins, including bursts of 24 sign-ins in ten seconds. Its telemetry covered 45 application registrations at about 18 organizations, with more than 33 authenticating successfully.

Todyl counted access reaching 27 organizations, 81 downloaded files and roughly 2,279 mailbox items. Those numbers reflect the security provider’s monitored customer set, not a global victim count, and the company described the incident as ongoing while it continued updating its findings.

The shared evidence points to a credential attack accelerated by an agent. It does not establish that every suspicious request came from ARTEX, and one address Microsoft listed was a Tor exit node that could include unrelated activity.

Five-Minute Cloud Access Changes Secret Response

Removing a secret from a repository does not invalidate it. Copies can remain in commit history, caches, archives and logs, while the credential stays usable until its owner revokes or rotates it. Organizations should treat any publicly exposed secret as compromised immediately.

Microsoft recommends removing credentials, certificates and federated identities from affected applications, revoking issued sessions where possible and rotating everything stored in any accessible Key Vault. Investigators should also review Azure activity, Entra, Storage, Microsoft 365 and Azure DevOps audit logs.

Behavioral detection becomes important once attackers change addresses and user agents. Useful signals include one source authenticating to several service principals, mixed failed and successful secret attempts, or one application requesting tokens across Resource Manager, Key Vault, Storage and Microsoft Graph in quick succession.

GitGuardian’s analysis says organizations should prioritize valid, high-privilege credentials and inspect internal repositories as well as public GitHub. It also stresses that deleting a commit is not remediation without credential rotation and historical-use review.

ARTEX Scales an Existing Credential Weakness

The campaign does not make cloud compromise automatic. ARTEX still needs a usable secret and inherits the permissions granted to that identity. Least-privileged roles, managed identities, short-lived credentials and network restrictions can sharply reduce what a discovered secret unlocks.

The change is economic and operational: an agent can search more repositories, test more identities and pivot through services faster than a human operator. That compresses the time available for secret-scanning alerts, ticket assignment and manual containment.

Defenders should compare machine-speed response against machine-speed attack paths. Pre-commit blocking, public exposure monitoring, automatic credential revocation and workload-identity policies can act before an analyst reviews the full incident, while human investigators determine scope and downstream consequences.

Microsoft’s report is also a product-vendor assessment and promotes its own defenses. Todyl’s matching telemetry and GitGuardian’s separate analysis strengthen the central finding, while leaving the actor’s identity, complete victim count and the precise role of AI in every observed action unresolved.

Illustrative feature image: server racks at the National Energy Research Scientific Computing Center, photographed by Derrick Coetzee, via Wikimedia Commons under CC0 1.0. Cropped to 16:9; the photograph does not show Microsoft, Azure, ARTEX or any affected organization.

Background Reading

• CrowdStrike AI Kill Switch Launches in Falcon Guardian
• AWS Kiro Bots Launch With Persistent Memory and Scheduled Work