ARTEX: an agent went from GitHub secrets to Azure Key Vault in 5 minutes

01What happened

Microsoft Threat Intelligence and Microsoft Security Research published this campaign on November 5, 2026. Starting in August 2026, they observed threat actors using an agentic AI offensive framework to submit large volumes of GitHub queries for secrets, often pairing a target organization's name with cloud or AI service keywords. Microsoft does not attribute the activity to a named group.

02How it works

ARTEX is an agentic offensive framework whose default tools include Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright. Once a client secret was found, the agent signed in as that application's service principal, enumerated resources through Azure Resource Manager and read whatever the role allowed. The agent also corrected its own mistakes: a Key Vault secret-enumeration batch that returned HTTP 400 for using a data-plane API version was rerun about 28 seconds later with ARM version 2023-07-01 and returned HTTP 200.

03Who is affected

Organizations whose OAuth application secrets, certificates or tokens ever reached a public repository are in scope, as are tenants that trust a vendor-owned multitenant application: Microsoft says one such credential was used to reach downstream tenants. Service principal sign-ins were seen across dozens of applications in multiple tenants from October 28, 2026, with separate reconnaissance against AI workloads on Azure AI services.

04What to do

Treat any credential that reached a public repository as compromised, rotate it, review its historical use, and rotate everything in any Key Vault the affected applications could read. Remove client secrets, certificates and federated credentials from affected app registrations, revoke Entra sessions and Azure DevOps personal access tokens, and move OAuth applications to managed identities.

Questions people ask

How do I check whether an attack agent used my leaked OAuth secret?

Microsoft advises reviewing service principal and other non-interactive sign-in logs for failures followed quickly by successes, and for one address authenticating to three or more service principals with mixed results. Sign-in errors AADSTS7000215 and AADSTS7000222 show invalid or expired secrets being tried. Microsoft's hunting queries start at 2026-10-28T00:00:00Z and also cover Azure Activity, Key Vault, Entra audit and Azure DevOps logs.

Does deleting a secret from a public repository make it safe again?

Microsoft states that publicly exposed credentials should be treated as compromised even after removal, because an agent may already hold them. Rotate the credential, review its historical use, and rotate everything in any Key Vault the affected application could read. Microsoft also recommends migrating OAuth applications from secret-based authentication to managed identities and restricting who may register applications.

Which Azure services did the agents reach after signing in?

Microsoft observed the agents reading Azure Key Vault and Storage accounts, enumerating App Service, Azure Kubernetes Service, Azure SQL and Application Insights, searching Azure DevOps for further secrets, and running commands on virtual machines through Run Command. SharePoint, OneDrive and mailbox items were reached through Microsoft Graph. The agents repeatedly sought API keys for major AI providers.

Do honeypots help against an autonomous attack agent?

Microsoft reports that honeypots, decoys, tarpits and fake wins reduced attack traffic reaching real assets in its own testing, and produced high-confidence signal. Decoys hand the agent worthless targets, tarpits spend its time and budget, and a false success can make it stop early. Microsoft presents these as additions to least privilege and secret hygiene, not replacements.

Sources 2 links, all fetched

1. 1microsoft.comMicrosoft Analysis
2. 2microsoft.comEarlier ARTEX Campaign