Microsoft says agentic tool hunts GitHub secrets to enter Azure tenants

Microsoft says agentic tool hunts GitHub secrets to enter Azure tenants

9 November 2026: Microsoft has described attackers using an AI framework called ARTEX to search public GitHub repositories for secrets, then sign in to Entra ID tenants as the applications those secrets belong to. There is no patch to apply, because no Microsoft flaw is involved: the defence is to find and replace exposed credentials and to hunt back to at least 28 October.

Not yet independently verified. The counts of organisations and files come from Todyl alone and cover only customers sending it logs. Microsoft's post of 5 November 2026 confirms the method and the addresses but gives no victim numbers. We will update this when it can be confirmed, and remove this note.

From a public repository to Key Vault in five minutes

Microsoft says that from August 2026 the framework has submitted large volumes of GitHub queries, often combining a target organisation's name, words associated with secrets, and terms linked to cloud services or AI providers. "In at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes," its researchers wrote.

From as early as 28 October, valid application credentials were used for service principal sign-ins on dozens of applications across several tenants, primarily from 199.19.77.84 and 199.19.77.18. Microsoft cautions that the second address is a Tor exit node and may carry unrelated traffic. The operator went after calls that return more credentials, including storage account keys, App Service settings, connection strings, publishing credentials and Azure Kubernetes Service user credentials, then read SharePoint, OneDrive and mailbox items.

The tool also corrected itself. When a Key Vault request failed for using the wrong API version, a rerun with a valid version began about 28 seconds later and succeeded.

Managed service providers took the first hits

Todyl, a security provider serving managed service providers, first saw the activity on 1 November and calls it an identity attack that moves like a worm without being one. It counts about 45 app registrations targeted at roughly 18 organisations, more than 33 of which authenticated, and 27 organisations reached, including downstream clients in government, energy, transport, construction, legal and education. It reports searches across about 25 tenants, 81 files downloaded and around 2,279 mailbox items accessed, and says those are minimum figures.

Scripted clients made 95% of the sign-ins, in bursts of up to 24 in 10 seconds. In one case the actor downloaded a connector archive and signed in as that connector's app about 2.5 minutes later. Todyl adds that one partner was billed thousands of dollars of AI API usage in about 10 minutes, and that the operator has moved from stolen app secrets to replaying users' refresh tokens.

Rotation alone will not close this

Deleting a leaked secret does not invalidate it, Microsoft notes, and copies survive in edit history, caches, archives and logs. Any secret found in a public repository should be treated as compromised, along with its application.

Todyl's list is more specific than most. Search service principal and non-interactive sign-in logs from 28 October, and treat a failure followed by a success as urgent. Remove the secrets, certificates and federated credentials of any app the actor used, then rotate everything in every Key Vault it could read, and rotate AI service keys while checking their billing. Conditional Access must target workload identities, because a policy scoped to users will not stop an app sign-in. Service providers should also review Partner Center access and GDAP relationships.

Block 199.19.77.0/24 and 65.87.223.26, and expect some unrelated noise from the Tor address. Microsoft's longer-term advice is to replace secrets in code with managed identities.

Our cloud security category holds six products, among them Prisma.

Sources

• Microsoft Threat Intelligence: Threat actors use agentic AI tooling to find and abuse exposed secrets, 5 November 2026
• Todyl: Stolen App Credentials, Real Access (published 3 November, updated 6 November 2026), 6 November 2026