Any password, API key or app secret that was once visible in a public GitHub repository should be considered gone. Microsoft says attackers are now running an AI framework called ARTEX that combs public code for exactly that, then logs into Azure accounts with what it finds.
Microsoft’s own example is quick: five minutes from a GitHub search to data leaving an Azure Key Vault. ARTEX was built for penetration testing, and Microsoft’s threat intelligence team says criminals have taken it up.
The campaign has two phases, according to Microsoft’s security blog post of 5 November. From August 2026 the operators fired huge numbers of searches at GitHub, mixing a target company’s name with words for secrets, cloud services or rival AI providers. The stolen credentials were then put to work: logins as service principals, the accounts apps use, began by 28 October and covered dozens of applications in more than one tenant.
What the agents did next was routine for an intruder but fast for software. They mapped subscriptions and permissions, then asked for anything that hands over more credentials: storage keys, App Service settings, connection strings, Kubernetes logins. Some apps also gave access to SharePoint and OneDrive files. When a call failed, the agent switched API version or method and retried, succeeding after waits of about 28, 60 and 80 seconds. They also used Azure’s Run Command to execute scripts on virtual machines.
Microsoft lists four addresses to look for in sign-in logs. The busiest, 199.19.77.84, can be blocked in Conditional Access (workload identity policies need Workload ID Premium). A second, 199.19.77.18, is a Tor exit point and will also show unrelated visitors. Two more, 65.87.223.26 and 157.22.126.128, were tied to exploit attempts and to probing AI workloads.
Security firm Todyl, whose own investigation overlaps, puts the damage at about 45 app registrations across roughly 18 organisations, with the actor reaching 27 in all, among them clients of managed service providers. It counts at least 81 downloaded files and 2,279 mailbox items, and says one partner was billed thousands of dollars for AI usage within about 10 minutes.
Microsoft’s first instruction is to change the key. Git history, caches and archives can keep a copy long after the file is gone. Cleaning up the repository afterwards does not undo the exposure. Affected apps should lose their client secrets and certificates, and anything held in a Key Vault they could read should be changed too. Logs should be searched back to 28 October. Two Entra error codes, AADSTS7000215 and AADSTS7000222, are worth searching for. A failed attempt followed by a successful one for the same app is the pattern to chase first.
Longer term, Microsoft points to GitHub secret scanning with push protection, managed identities in place of client secrets, and narrowly scoped access for every app identity.
