Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Scanning GitHub

Microsoft says threat actors are using an AI tool called ARTEX to find secrets in public GitHub code and use them against cloud accounts.

In one case, the AI agent went from searching GitHub to pulling data from Azure Key Vault in only five minutes.

ARTEX AI Azure Key Vault secrets

Searching public code for passwords and keys is an old trick. It was slow because a person had to find the repositories, read the code and test each secret by hand. Microsoft Threat Intelligence now reports that agentic AI tools remove much of that delay.

The agents scan many repositories at once, read the results and carry on with the next steps without a human at the keyboard.

Starting in August 2026, the threat actors sent large numbers of search queries to GitHub. The queries often held the name of a target company, a word linked to secrets, a cloud service term, or the name of another AI provider. The goal was to find application credentials, cloud keys and AI API keys that developers had left in code.

ARTEX is the framework behind much of this work. It was built as a penetration testing tool, but criminals and state-linked groups have picked it up.

Our earlier report on how ARTEX automates enterprise intrusions at machine speed explains how its AI agents plan tasks, run tools and decide what to do next.

According to technical research published by Microsoft, the second stage began as early as October 28, 2026. Microsoft saw successful service principal sign-ins from the IP address 199.19.77[.]84 across several application IDs.

A service principal is the identity an app uses to sign in, so a stolen app secret lets an intruder act as that app. In some cases, a vendor-owned multitenant app was compromised and then used to reach many downstream customers.

Once inside, the agents listed subscriptions, resource groups, permissions and AI model deployments. They went after operations that return credentials, such as storage account keys, App Service settings, connection strings and Kubernetes user credentials.

Some compromised apps also reached SharePoint and OneDrive, downloaded files and searched content through Microsoft Graph.

The agents also seemed to learn from their mistakes. When a cloud request failed with an HTTP 400 error, the tool changed the API version or method and tried again. One Key Vault request was rerun about 28 seconds after it failed, and the retry worked.

The agents also used the Azure Run Command feature to run scripts on virtual machines, which can expose stored credentials or give the intruder a way to stay in.

Microsoft says its findings overlap with work from security firm Todyl. Todyl’s investigation found about 45 app registrations at roughly 18 organizations. It says the actor reached 27 organizations, including clients of managed service providers.

It also reports 81 downloaded files and about 2,279 mailbox items accessed, and says these numbers are a minimum.

Todyl also saw scripted sign-ins in bursts of up to 24 in 10 seconds. Microsoft named two more IP addresses. The address 65.87.223[.]26 showed shell commands hidden in a user agent and attempts to get App Service tokens.

The address 157.22.126[.]128 scouted AI workloads on Azure AI services. Microsoft also listed 199.19.77[.]18 as a Tor exit node that may bring unrelated noise.

Our coverage of stolen Entra ID and Azure DevOps credentials gives more background on the MSP side of this campaign. The agents showed a clear interest in AI service keys and in apps with access to Foundry Tools. Todyl noted that one partner saw thousands of dollars in AI usage charges in about 10 minutes.

The first rule is simple. A secret that was ever public must be treated as stolen. Microsoft stresses that deleting the code does not fix the problem, because old copies can remain in edit history, caches and archives. Rotate the key at once and check how it was used.

GitHub secret scanning checks full Git history and can warn you when a key leaks. Its public monitoring option also watches for secrets leaked by your staff in public repositories outside your own. Teams on Azure DevOps can turn on secret scanning and push protection to block secrets before they are pushed.

Microsoft also advises moving apps away from client secrets and toward managed identities, which remove the risk of secrets sitting in code. Other steps include least privilege for service principals and Defender for Cloud plans for Key Vault, Storage and Resource Manager.

Teams can also use Conditional Access for workload identities and block 199.19.77[.]84/32 as a named location. Block that exact address and not the whole network range.

Defenders should check Entra service principal and non-interactive sign-in logs for 199.19.77[.]84 and 199.19.77[.]18. Error codes AADSTS7000215 and AADSTS7000222 mean someone holds a credential for your app, and a failure followed by a success is urgent. Look back to at least October 28 and as far as log retention allows.

Because the agents change IP addresses and user agents fast, behavior is a better clue. Watch for one address signing in to three or more service principals, or one app asking for tokens across Resource Manager, Key Vault, Storage and Graph within minutes.

Microsoft also suggests honeypots and decoys to pull AI agents toward worthless targets. Our report on ARTEX-linked ConnectWise tenant targeting shows how fast these tools can move across many tenants.

The post Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Scanning GitHub appeared first on Cyber Security News.