Microsoft has now put a clock on a problem security teams already knew they had. In a November 5, 2026 post, Microsoft Threat Intelligence says attackers are using the ARTEX agentic framework to search public GitHub repositories for exposed credentials, application secrets and AI API keys, then use those secrets against the victim’s cloud. “In at least one case,” Microsoft writes, “Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes.”
Quick Take
- Tooling: ARTEX, an open-source agentic offensive framework, used to scan GitHub and then act on what it finds.
- Speed: In one observed case, GitHub secret to Azure Key Vault exfiltration in five minutes.
- Follow-on (from October 28): Successful service-principal sign-ins from 199.19.77.84, including cases where a vendor-owned multitenant app credential was reused across downstream tenants. Actors also used 65.87.223.26 and 157.22.126.128 in related activity.
- What was taken: Cloud discovery, credentials and data from Azure Key Vaults and Storage Accounts, abuse of Azure AI services, SharePoint and OneDrive access, and Microsoft Graph searches in some tenants. Agents also used Azure VM Run Command and hunted Azure DevOps for more secrets.
- First step: Rotate any secret that has ever appeared in a public repository. Deleting the file is not enough.
What happened
Searching GitHub for leaked keys is an old technique. Microsoft’s point is that agents collapse the slow human loop — find a repo, read it, try the key, pivot — into a single automated chain. Starting in August 2026, Microsoft saw ARTEX-class tooling submit large volumes of GitHub queries that often included a target organization name plus keywords for secrets, cloud services, or another AI provider.
From October 28, Microsoft watched a follow-on wave of service-principal sign-ins from 199.19.77.84 (and a Tor exit at 199.19.77.18, which it cautions may also carry unrelated traffic). In some cases a compromised credential for a vendor-owned, multitenant application opened more than one customer tenant. Once inside, the actor asked Azure for the kinds of things that yield more credentials: storage account keys, App Service settings, connection strings, AI and ML datastores, and AKS user credentials.
Microsoft also describes behaviour that looks like an agent debugging itself against the cloud APIs: a batch of Azure Resource Manager requests failed with HTTP 400 because the wrong API version was used; about 28 to 80 seconds later the same paths were retried with a supported version and returned HTTP 200. That is not a smoking gun by itself, but it is the kind of tight retry loop defenders should look for.
The agents, Microsoft says, showed a repeated interest in credentials that lead to AI services — API keys for major providers and OAuth apps with access to Foundry Tools (formerly Azure Cognitive Services). In other words, the campaign is also a way to steal the fuel for the next agent run.
What you should do
Microsoft’s own mitigation list is the checklist:
- Scan GitHub (including public copies and history) for secrets; enable secret scanning and push protection. Rotate anything that was ever exposed.
- Prefer managed identities over long-lived client secrets in code.
- Block 199.19.77.84/32 in Conditional Access for workload identities, and hunt Entra service-principal sign-ins and Key Vault, Storage, Graph, and Azure DevOps audit logs for that address and for 65.87.223.26.
- For any affected application, remove client secrets, certificates and federated credentials — including any the actor may have added — and rotate everything in Key Vaults that app could read. Issued tokens remain valid until they expire.
What it means
Five minutes is the sentence that will travel. It does not mean every leaked .env file becomes a Key Vault breach, and Microsoft is not describing a fully autonomous worm. It does mean the window between “someone pasted a secret into a public repo” and “someone else’s agent is inside the tenant” is now shorter than most incident-response playbooks assume.
This campaign sits alongside Microsoft’s October 21 Storm-0940 / ConnectWise report: the same class of ARTEX tooling, now clearly in use both as a nation-state adjunct and as a secrets-to-cloud pipeline.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on Microsoft’s November 5, 2026 Security Blog post. i10x did not have access to the underlying telemetry.
