Microsoft Threat Intelligence published two reports on November 5 and 6, 2026 about attackers using ARTEX, an AI penetration-testing framework. The earlier coverage here focused on the traces such tools leave. These reports give a clearer picture of how fast the attack chain now moves.
From a public secret to cloud data
Since August, Microsoft says, attackers have used an agentic framework to send large volumes of GitHub queries combining a target organisation's name with keywords for secrets, cloud services or AI providers. Searching code for credentials is old. What has changed is that the agent can also interpret the results and act on them. Microsoft writes: "In at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes."
A follow-on campaign, seen from October 28, used valid application credentials for service principal sign-ins, including a multitenant credential compromised at the vendor and then used against downstream customers. The agent went after operations that return more credentials: storage account keys, App Service settings, connection strings and Kubernetes credentials. It also read SharePoint and OneDrive files. Microsoft notes "adaptive troubleshooting" in the logs, where failed cloud API calls were followed by changed methods or API versions and then successful responses.
One detail stands out for AI teams. The agents "repeatedly demonstrated a focus on credentials that provide access to AI services", and Microsoft says multiple public reports describe attackers stealing such credentials, sometimes to run the same agentic workflow. A leaked model API key can therefore pay for the next attack.
A second campaign and an unusual defence
The November 6 report describes Storm-3358, which Microsoft calls a Cambodia-based cluster mainly targeting financial organisations in Southeast Asia. Since October it has used ARTEX with conventional scanners to exploit file upload and server-side request forgery flaws and install open-source remote access tools.
Microsoft's guidance includes the expected steps: rotate exposed secrets, enable push protection and replace client secrets with managed identities. It adds that "Publicly exposed credentials remain usable until revoked or rotated", and that tokens already issued stay valid until expiry. Sign-in errors AADSTS7000215 or AADSTS7000222 indicate someone is holding a credential for your application.
The newer advice is aimed at the agent itself. Honeypots offer worthless targets, tarpits burn its time and budget, and "fake wins" present convincing evidence that its objective is complete, so that it stops. Microsoft says these controls reduced attack traffic reaching real assets in its own testing.
What remains uncertain. The five-minute figure is one observed case, and Cybersecurity Dive reports it is unclear who is behind the GitHub scanning. Microsoft sells the detection and deception products it mentions, and it has not published how often its decoys worked. The IP addresses it lists can change quickly, and one is a Tor exit node that may carry unrelated traffic.
Analysis: Yesterday's Apiiro count showed how secrets reach public files, and these reports show how little time may follow. Dinky's team at Belgavi's Book Store should assume a key committed to a public repository is compromised on the first push, and script rotation in advance instead of writing a runbook during an incident. Give the store's model API keys spending caps and separate alerts, since those keys are now a target in their own right. A decoy credential in a private repository that alerts when used is cheap to add.
Sources and evidence
- Threat actors use agentic AI tooling to find and abuse exposed secrets (Microsoft Security Blog, November 5)
- ARTEX abuse expands as cybercriminals target financial sector (Microsoft Security Blog, November 6)
- Hackers enlist Artex to scan GitHub repositories for exposed secrets (Cybersecurity Dive, November 6)
Microsoft says attackers using ARTEX have searched GitHub for secrets since August, and in one case an agent went from search to Azure Key Vault exfiltration in five minutes. Agents favoured AI service credentials. A separate cluster targets financial firms. Rotate on first exposure, cap AI keys, and consider decoys built for agents, though Microsoft has not published how often they work.