ARTEX agentic AI framework used to harvest leaked GitHub secrets and breach Azure and Entra ID tenants, reaching Key Vault in 5 minutes
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 07/11/2026 00:04; os links antigos trazem para cá.
Microsoft Threat Intelligence reported on 5 November 2026 that threat actors are using the agentic offensive security framework ARTEX, and similar AI tooling, to mass-query public GitHub repositories for exposed credentials, OAuth application secrets and AI inference API keys. The stolen secrets are then abused automatically against the victim's cloud tenant with little human input (cybersecuritydive.com, gbhackers.com). The activity began in August 2026, when high-volume GitHub searches combined a target organization's name with keywords for secrets, cloud services or AI providers. In one intrusion, an AI agent went from scanning GitHub for secrets to exfiltrating Azure Key Vault data in about five minutes (gbhackers.com, cybersecuritydive.com). Stolen Entra ID application credentials were used to sign into Microsoft 365 and Azure environments, including at managed service providers. In at least one case a vendor-owned multitenant application was compromised at the source and reused across downstream tenants (cybersecuritydive.com). Attribution for this GitHub scanning is not established. ARTEX was previously tied to a China-nexus actor, tracked as Storm-0940, that abused ConnectWise Cloud Backup. Todyl reported related activity from the same IP addresses.
Detalhes técnicos
- Earliest observed successful service principal sign-ins came from 199.19.77[.]84 on 28 October 2026, across multiple application IDs and impacted customers. They were used for cloud resource discovery, credential and data exfiltration from Azure Key Vaults and Storage Accounts, and abuse of Azure AI services (cybersecuritydive.com, gbhackers.com).
- Other infrastructure: sign-ins from 199.19.77[.]18, a Tor exit node; reconnaissance against victim Azure AI workloads from 157.22.126[.]128; and operations from 65.87.223[.]26 that included shell commands embedded in a user agent and attempts to obtain App Service authentication tokens (cybersecuritydive.com).
- GitHub queries targeted OAuth application secrets and inference API keys (gbhackers.com).
- After sign-in, the agents enumerated subscriptions, resource groups, permissions, AI deployments and service configurations (gbhackers.com).
- They targeted operations returning storage account keys, App Service settings, connection strings, publishing credentials, AI/ML connections and datastores, and AKS user credentials (both sources).
- They accessed SharePoint and OneDrive content, downloaded files, read mailbox items and used Microsoft Graph search requests to find valuable content (both sources).
- They obtained tokens for single-tenant OAuth applications, searched Azure DevOps for further secrets, and used Azure VM Run Command to execute scripts on virtual machines (cybersecuritydive.com, gbhackers.com).
- Adaptive error correction: failed HTTP 400 responses in ARM telemetry were followed within tens of seconds by retries that returned 200 (cybersecuritydive.com). A failed Key Vault metadata request mixed data-plane API versions with ARM endpoints and succeeded about 28 seconds later with ARM API version 2023-07-01. Similar fixes followed failed Azure SQL firewall enumeration (about 60 seconds) and Application Insights queries (about 80 seconds) (gbhackers.com).
Remediação
- Scan GitHub code for secrets, remove them and immediately rotate any exposed keys or credentials (cybersecuritydive.com). Deleting repository content does not invalidate a secret (gbhackers.com).
- Rotate every secret reachable through compromised vaults, not only the credential that was first exposed (gbhackers.com).
- Investigate service principal sign-ins, Key Vault reads, storage downloads, Graph activity and application credential changes, and hunt for the IP addresses above (gbhackers.com).
- Enable GitHub secret scanning, which covers repository history, and monitor public repositories for enterprise members leaking secrets. Use Azure DevOps secret scanning and push protection (gbhackers.com).
- Move to managed identities or workload identity federation, and apply least privilege (gbhackers.com).
- The cybersecuritydive.com remediation text was truncated in the input, so further guidance from it is not captured here.
Relatos divergentes
- Attribution: cybersecuritydive.com says attribution for the GitHub scanning is not established and notes only that ARTEX was previously linked to Storm-0940. gbhackers.com goes further and warns that the earlier ARTEX attribution to Storm-0940 (ConnectWise compromise) should not be applied automatically to this activity. Both agree there is no confirmed actor.
- Todyl's findings: cybersecuritydive.com describes Todyl's report as a similar campaign involving the same IP addresses. gbhackers.com adds that Todyl assessed AI involvement with low confidence and named no framework. gbhackers.com is more specific on this point.
- Sourcing: gbhackers.com states its summary comes from the article alone and that no Microsoft primary source was opened. cybersecuritydive.com attributes its details to Microsoft's reporting. The Microsoft-attributed details are therefore second-hand in both cases.
Linha do tempo
-
Threat actors use ARTEX agentic AI framework to harvest secrets from public GitHub repos and pivot into Entra ID tenants
ler a análise desta fonte ocultar
Microsoft Threat Intelligence reported on 5 November 2026 that threat actors are using the agentic offensive security framework ARTEX and similar AI tooling to mass-query public GitHub repositories for exposed credentials, OAuth application secrets and AI inference API keys, then automatically abuse them against the victim's cloud tenant. The activity began in August 2026, with the AI framework submitting large volumes of GitHub queries combining a target organization's name with keywords for secrets, cloud services or AI providers (microsoft.com). Stolen Entra ID application credentials were then used to sign into Microsoft 365 and Azure environments, including at managed service providers, with at least one case of a vendor-owned multitenant application compromised at the source and reused across downstream tenants (microsoft.com). Microsoft observed an AI agent progress from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes (microsoft.com). The article notes attribution for the GitHub scanning is not established, while ARTEX was previously tied to a China-nexus actor abusing ConnectWise Cloud Backup; Microsoft's earlier reporting names that activity Storm-0940 (microsoft.com).
Technical Details
As early as 28 October 2026, Microsoft observed successful service principal sign-ins from 199.19.77[.]84 involving multiple application IDs across impacted customers, used for cloud resource discovery and credential and data exfiltration from Azure Key Vaults and Storage Accounts, plus abuse of Azure AI services (microsoft.com). Sign-ins also came from 199.19.77[.]18, a Tor exit node; reconnaissance against victim Azure AI workloads came from 157.22.126[.]128, and operations from 65.87.223[.]26 included shell commands embedded in a user agent and attempts to obtain App Service authentication tokens (microsoft.com). The actor targeted operations returning storage account keys, App Service settings, connection strings and publishing credentials, AI/ML connections and datastores and AKS user credentials, then accessed SharePoint and OneDrive content, downloaded files, read mailbox items and issued Microsoft Graph search requests (microsoft.com). ARM telemetry showed adaptive behaviour: failed HTTP 400 responses were followed within tens of seconds by retries with corrected API versions or HTTP methods returning 200 (microsoft.com). Agents also obtained tokens for single-tenant OAuth applications, searched Azure DevOps for further secrets and used Run Command to execute scripts on Azure VMs (microsoft.com). Todyl reported a similar campaign involving the same IP addresses (microsoft.com).
Remediation
Organizations should scan their GitHub code for secrets, remove them and immediately rotate any exposed keys or credentials, treating any secret found in a public repository and its associated application as compromised; removing the original commit alone does not remediate the exposure (microsoft.com). Microsoft recommends enabling GitHub secret scanning and public monitoring, push protection, GitHub Advanced Security / Secret Protection for Azure DevOps, enforcing least privilege on workload identities, enabling Defender for Cloud protections and migrating OAuth applications from client secrets to managed identities (microsoft.com). Defenders should hunt for service principal sign-ins from the listed IP addresses and for unexpected Key Vault, Storage, Graph and Run Command activity by application identities.
-
ARTEX agentic AI framework used to steal Azure Key Vault secrets within 5 minutes of finding leaked GitHub credentials
ler a análise desta fonte ocultar
Microsoft reports that attackers are using the ARTEX agentic AI framework to find exposed credentials on GitHub and compromise Azure environments with little human input. In one intrusion, an AI agent went from searching GitHub for application secrets to exfiltrating Azure Key Vault data in about five minutes. Microsoft saw high-volume GitHub searches from August 2026. It saw follow-on successful Microsoft Entra service principal sign-ins from 199.19.77[.]84 as early as October 28. Todyl reported related abuse from the same address but assessed AI involvement with low confidence and named no framework. The earlier ARTEX attribution to Storm-0940 (ConnectWise compromise) should not be applied automatically to this activity.
Technical Details
- GitHub queries combined organization names with keywords for credentials, cloud services and AI providers. They targeted OAuth application secrets and inference API keys.
- Stolen service principal credentials sometimes belonged to vendor-operated multitenant applications, which extended exposure to downstream customers.
- After sign-in, the agents enumerated subscriptions, resource groups, permissions, AI deployments and service configurations.
- They targeted storage account keys, App Service settings, connection strings, publishing credentials, machine learning connections and AKS user credentials.
- They accessed SharePoint, OneDrive and mailbox items, using Microsoft Graph searches to find valuable content.
- They abused Azure VM Run Command to execute scripts on virtual machines.
- Microsoft saw adaptive error correction. A failed Key Vault metadata request mixed data-plane API versions with ARM endpoints and was retried successfully about 28 seconds later with ARM API version 2023-07-01. Similar fixes followed failed Azure SQL firewall enumeration (about 60 seconds) and Application Insights queries (about 80 seconds).
Remediation
- Revoke or rotate exposed credentials. Deleting repository content does not invalidate them.
- Rotate every secret reachable through compromised vaults, not only the credential that was first exposed.
- Investigate service principal sign-ins, Key Vault reads, storage downloads, Graph activity and application credential changes.
- Enable GitHub secret scanning, which covers repository history. Monitor public repositories for enterprise members leaking secrets. Use Azure DevOps secret scanning and push protection.
- Move to managed identities or workload identity federation, and apply least privilege.
This summary comes from the article alone. No Microsoft primary source was opened.