Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes

Hackers are using the ARTEX AI framework to find exposed credentials on GitHub and turn them into access to cloud systems.

In one observed case, an AI agent moved from searching public repositories for application secrets to stealing data from Azure Key Vault in just five minutes, showing how quickly a coding mistake can become a cloud security incident.

The operation combines credential hunting, automated analysis, and follow-on attacks with less hands-on work from human operators.

Instead of simply collecting leaked keys, the agents investigate what those keys can access and pursue valuable resources. The five-minute finding describes one documented case, not the time required for every attack involving the framework.

Microsoft Threat Intelligence and Microsoft Security Research identified the malicious activity in a November 5 report, tracing GitHub scanning to August 2026.

Researchers described ARTEX as an offensive AI framework, rather than a conventional malware family.

Earlier reporting on ARTEX enterprise attack automation explains how agents interpret results and select subsequent actions, helping attackers connect familiar weaknesses faster.

Hackers Use ARTEX AI to Find GitHub Secrets

The agents submitted large volumes of GitHub searches combining target organization names with terms associated with secrets, cloud platforms, and AI providers.

Exposed material included application credentials and API keys for AI inference services. These searches target authentication data accidentally committed in scripts, configuration files, or other source code.

Once useful credentials were found, agents obtained tokens for compromised OAuth applications and used their permissions to explore cloud resources.

Microsoft observed agents extracting Azure Key Vault secrets and searching Azure DevOps for additional credentials. The wider problem of active GitHub credential exposure helps explain why this approach remains effective: publicly disclosed secrets can remain usable until their owners revoke or rotate them.

In follow-on activity beginning as early as October 28, attackers used valid application credentials to access Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources.

Service principals, the identities applications use to authenticate, enabled access to dozens of applications across multiple tenants. Some compromised credentials belonged to vendor-owned multitenant applications, extending the risk to downstream customers.

The attackers mapped subscriptions, permissions, resource groups, and AI deployments. They targeted storage keys, connection strings, App Service settings, publishing credentials, and Azure Kubernetes Service credentials.

Compromised applications also accessed SharePoint and OneDrive, with observed file downloads and mailbox-item access. Agents additionally used Azure VM Run Command, a legitimate feature that can execute scripts inside virtual machines.

The activity showed adaptive troubleshooting. After failed requests mixed Key Vault data-plane API versions with Azure Resource Manager control-plane endpoints, the agent retried approximately 28 seconds later using ARM version 2023-07-01 and received successful responses.

Similar corrections followed failed Azure SQL and Application Insights requests. Such behavior supports the broader concern around autonomous AI credential theft, where automation can reduce delays between discovery and misuse.

Detecting and Containing AI-Driven Cloud Credential Abuse

Microsoft recommends treating publicly exposed credentials as compromised, even after developers delete the original code.

Responders should revoke or rotate affected secrets, investigate historical use, and replace credentials stored in any Key Vault the compromised application could read. Disabling affected service principals may be necessary; already-issued tokens remain valid until expiry.

Detection should connect identity events with subsequent cloud operations. Security teams should review Entra service-principal sign-ins, Azure Activity records, Key Vault diagnostics, storage logs, and Microsoft 365 audit data.

One address accessing several service principals, or one application rapidly requesting tokens across ARM, Key Vault, Storage, and Graph, warrants investigation. IP matches alone should not determine attribution.

Longer-term protection means reducing reliance on long-lived secrets through managed identities, enforcing least privilege, and enabling GitHub secret scanning and push protection.

Microsoft also recommends monitoring secondary public repositories for leaked organizational credentials.

Behavioral detections remain essential because attackers can change source addresses and user-agent strings, while legitimate tools can produce traffic resembling individual attack steps.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes appeared first on Cyber Security News.