Threat intel

ARTEX agents turn leaked GitHub secrets into Azure access

By Yaali. November 10, 2026, 6 min read, Threat intel, Identity.

Microsoft says ARTEX AI agents search GitHub for app secrets and reach Key Vault in minutes, and a Cambodian group now aims it at banks. What to check.

Microsoft Threat Intelligence published two reports on November 5 and 6 about ARTEX, the open-source agentic penetration testing framework released in July 2026. The first describes ARTEX agents searching public GitHub repositories for application secrets, signing in to Microsoft Entra ID as the matching service principals across dozens of applications in multiple tenants, and then pulling credentials out of Azure. In one case an agent went from a GitHub search to stealing Key Vault data in five minutes. The second names Storm-3358, a financially motivated cluster based in Cambodia, which has used ARTEX against financial organizations since October, mostly in Southeast Asia.

You are exposed if any Entra app registration in your tenant authenticates with a client secret and that secret, or an AI provider API key, has ever been committed to a public repository. Deleting the commit does not help: Microsoft's advice is to treat any secret that reached a public repository, and the application behind it, as compromised. Banks and payment firms in Southeast Asia should also read the Storm-3358 section, because that group adds web exploitation and remote access trojans on top.

How it works

A service principal is the identity an application uses in Entra ID. When a developer registers an app and gives it a client secret, anything that holds the application ID, the tenant and that secret can request tokens and act with the app's permissions, with no user, no MFA prompt and no device check. Those secrets end up in configuration files, notebooks and CI scripts, and from there in public commits.

Microsoft says it began seeing large volumes of GitHub searches from the framework in August 2026. The queries combined a target organization's name with secret-related keywords and either a cloud service keyword or the name of an AI provider. Agents then read the results and tested what they found. The targets included OAuth app client secrets, API keys for major AI services, and apps with access to Foundry Tools, formerly Azure Cognitive Services.

The agents adapt as they go. When an Azure Resource Manager (ARM) call failed with HTTP 400, the agent changed the API version or HTTP method and tried again until it got HTTP 200: about 28 seconds later for Key Vault secret metadata, 60 seconds for Azure SQL firewall rules and 80 seconds for an Application Insights query. With a working token, the agents asked ARM for whatever it would return: storage account keys, App Service settings and publishing credentials, connection strings, AI and machine learning datastores, and Azure Kubernetes Service user credentials. They read Key Vault secrets and storage accounts, used Run Command on Azure virtual machines, downloaded files from SharePoint and OneDrive, accessed mailbox items, searched through Microsoft Graph and hunted for more secrets in Azure DevOps. One multitenant application credential, stolen at the vendor that publishes the app, gave access to several downstream customer tenants.

What attackers are doing

The November 5 report does not name an actor. Microsoft first saw successful service principal sign-ins from 199.19.77[.]84 on October 28, plus activity from 199.19.77[.]18, a Tor exit node that may also carry unrelated traffic. Two more addresses appear: 65.87.223[.]26 put shell commands in a user agent and tried to obtain App Service authentication tokens, and 157.22.126[.]128 performed reconnaissance of Azure AI workloads.

Storm-3358, in the November 6 report, mixes ARTEX with conventional scanners against internet-facing web servers. It exploits anonymous file upload and server-side request forgery (SSRF) flaws, where a server can be made to fetch URLs on the attacker's behalf, and Microsoft names no CVEs. It also uses OAuth application secrets exposed on GitHub. Its agents fetched the WISP, vshell and AdaptixC2 remote access trojans with curl and netcat and planted web shells. Microsoft lists WISP command servers at 199.19.95[.]66 to 199.19.95[.]68 (first seen November 2) and ARTEX servers at 91.92.240[.]238, 85.11.168[.]45, 31.77.229[.]35 and 178.16.54[.]129. Microsoft's own Sentinel query writes the last one as 178.15.54.129, so search for both.

The tool is easy to get. Censys counted 1,465 hosts with an exposed ARTEX console on November 4, roughly 815 once identically configured hosting blocks are collapsed, mostly on the default port 8787. 155 of those hosts also ran vshell, Cobalt Strike or Adaptix C2. ARTEX has said it will go closed source, but TechCrunch reports dozens of copies remain on code-sharing sites.

What to do

1. Find leaked secrets first. Run secret scanning across your public and private GitHub repositories, including history, and turn on push protection, or GitHub Advanced Security for Azure DevOps. For every hit that is an Entra client secret or an AI API key, treat the app as compromised.
2. Contain each affected app. Remove all client secrets, certificates and federated credentials on it, including any you did not create, and disable the service principal if the business can tolerate it. Tokens already issued stay valid until they expire, so removing the secret does not end a live session. Revoke Entra sessions, Azure DevOps personal access tokens and SSH keys for any users involved.
3. Block the known address. Add 199.19.77[.]84/32 as a named location and block it in a Conditional Access policy for workload identities, assigned to service principals, plus a user-scoped block for replayed sessions. Workload identity policies need Workload ID Premium and cover only single-tenant apps registered in your tenant.
4. Check for past use. In the Entra service principal and non-interactive sign-in logs, a failure with AADSTS7000215 (invalid secret) or AADSTS7000222 (expired secret) followed by a success means someone holds a credential for that app. In Defender advanced hunting, start with:

EntraIdSpnSignInEvents
| where IPAddress in ("199.19.77.84", "199.19.77.18")
| project Timestamp, ServicePrincipalId, ResourceDisplayName, ErrorCode, UserAgent

Repeat the IP filter on GraphAPIAuditEvents, CloudAppEvents, CloudAuditEvents (add 65.87.223.26) and CloudStorageAggregatedEvents with SuccessfulOperationsCount > 0. Also look for one address authenticating to three or more service principals, or one app requesting tokens for Resource Manager, Key Vault, Storage and Graph within a short window. 5. Rotate downstream. Rotate every secret in any Key Vault the affected app could read, and the storage keys, connection strings and publishing credentials it could list. If you are a managed service provider, review Partner Center access, granular delegated admin (GDAP) relationships and customer tenants. 6. For Storm-3358 targets, search proxy, firewall and endpoint logs for the IP addresses above, and review web servers for new files in upload directories and unexpected curl or netcat downloads. 7. Harden. Move apps from client secrets to managed identities, set a maximum password secret lifetime with app management policies, set "Users can register applications" to No under Entra admin center, Users, User settings, and give service principals least-privilege RBAC roles.

The wider lesson

Five minutes from a GitHub search to Key Vault theft leaves no time for anyone to triage a secret scanning alert. Two controls hold up at that speed: secrets that never reach a repository, because push protection blocks them, and apps that have no secret to leak, because they use managed identities. Microsoft also says honeypots, decoy credentials and fake wins slowed autonomous agents in its own testing and gave clean, attributable alerts.

Our cloud and Kubernetes security reviews cover app registrations, secret lifetimes and what each service principal can reach, and red team code review looks for secrets in source and history. If you are not sure which of your apps still use client secrets, open the chat and Yaali, our AI agent, will pass the question to an engineer.

Sources: Microsoft: Threat actors use agentic AI tooling to find and abuse exposed secrets, Microsoft: ARTEX abuse expands as cybercriminals target financial sector, Let's Data Science, Upwind, Censys, TechCrunch.