ARTEX GitHub Secrets Attack: Microsoft Says AI Agents Hunt Exposed OAuth Credentials, What Is Confirmed and How to Check Yours

Microsoft says attackers are using an AI agent framework called ARTEX to search public GitHub repositories for leaked credentials, application secrets and AI service keys, then use what they find to get into company cloud accounts. If your company has ever put a credential in a public repository, treat it as stolen: in at least one case, Microsoft saw an agent go from scanning GitHub to taking data out of Azure Key Vault in five minutes.

What is the ARTEX hacking tool?

Microsoft describes ARTEX as an "open-source penetration testing framework." Tools like this exist for legitimate security testing, and this one is now being turned against real companies.

Security firm Wiz reports that a Chinese developer published ARTEX on GitHub in July 2026 and made it closed-source on October 8, 2026, by which point it had more than 12,000 forks. According to Wiz, an operator supplies a target and an objective. A planner agent then picks each next step, worker agents run common tools such as nmap and curl, and the results feed a shared map of assets and findings.

What Microsoft confirmed about the GitHub secrets attack

Microsoft Threat Intelligence published its report on November 5, 2026. It describes the following activity:

• August 2026: the GitHub searches began. Queries often combined a target organization's name with keywords for secrets, cloud services or AI providers.
• From October 28, 2026: agents signed in as service principals (the non-human accounts applications use) with leaked or stolen application credentials, mainly from 199.19.77.84 and 199.19.77.18.
• Scope: dozens of applications across multiple tenants.
• What the agents did: looked for operations that return credentials, such as storage keys and connection strings, accessed SharePoint and OneDrive, mapped Azure environments, obtained tokens for single-tenant OAuth applications, pulled secrets from Key Vault, searched Azure DevOps and used Run Command on virtual machines.
• AI services: the agents focused heavily on AI service credentials, including access to Foundry Tools.
• Speed: failed Azure requests were retried with corrected API versions and succeeded within about 30 to 80 seconds.

What is claimed and what is still not known

Claimed: that ARTEX breaks into sites with almost no human input. Wiz's description of an operator giving only a target and objective supports the general idea, and Microsoft says the automation cuts down hands-on work. Neither is a measurement of how often it succeeds alone. Wiz also said most of the attempts it described against Microsoft OAuth login flows failed.

Not known:

• How many organizations were affected. Microsoft gives no count and refers to "some impacted customers."
• Who is behind this GitHub activity. Microsoft does not name an actor for it. Its separate reports tie other ARTEX use to Storm-0940, a China-state aligned group (October 21 report), and to Storm-3358, a financially motivated group (November 6 report).
• Whether every listed IP address is tied only to this campaign. Microsoft notes that 199.19.77.18 is a Tor exit node and might be associated with unrelated malicious activity.

Microsoft's report does not describe GitHub itself being broken into. It describes credentials left where anyone could read them.

Why exposed GitHub secrets matter for a company network

A leaked application secret is a working login with no person attached. Microsoft's documentation notes that workload identities can't perform multifactor authentication, so the usual safety net does not apply. Many of these accounts also hold broad rights to storage, vaults and virtual machines.

Deleting the file does not solve it. In Microsoft's words: "Publicly exposed credentials remain usable until revoked or rotated." Copies can survive in edit history, caches, archives and logs.

The exposure may not even be yours. Microsoft describes a case where a multitenant application's credential was compromised at the vendor and used to reach multiple downstream tenants. That makes this a question for every vendor and contractor who touches your cloud, which is the same problem we covered in who is patching the software that runs your business. AI-built apps add to the risk, because keys often get pasted into code that nobody reviews, as we discussed in AI can build your app, who is going to keep it running.

How to check for exposed GitHub secrets: what to do this week

Microsoft says organizations that find exposed secrets should assume those secrets and the applications tied to them are compromised.

If your website, app or servers depend on keys stored in code, include those in the scan. Payment, email and AI provider keys belong on the rotation list too.

ARTEX questions people are asking

Is ARTEX malware?

Not in the usual sense. Microsoft describes it as a penetration testing framework. The concern is that attackers are using it.

Was GitHub hacked?

Microsoft's report does not say so. The agents searched public repositories for secrets people had left there.

We deleted the secret from an old commit. Are we safe?

No. Until the credential is revoked or rotated, it still works, and copies may exist elsewhere. Rotate it first, then clean up.

Is blocking the IP addresses enough?

No. Microsoft says threat actors can and do change the source IP address and user agent strings. Treat a block as one layer, and watch for behavior such as unexpected service principal sign-ins.

Does MFA stop this?

Not for these logins. Service principals can't perform multifactor authentication, which is why rotation, least privilege and managed identities matter.

Does this affect us if we do not use Azure?

Microsoft's detail on follow-on activity is about Azure and Microsoft 365, but the agents also searched for AI inference API keys and other credentials. Rotate any key that has been public, whatever service it belongs to.

Who is behind the ARTEX GitHub attacks?

Microsoft has not named an actor for this activity. It has named Storm-0940 and Storm-3358 in separate ARTEX reports.

The bigger lesson

Finding a forgotten key in a public repository used to take someone's time and attention. Microsoft's report shows software doing it, then acting on the result within minutes. The defense is not exotic: know where your credentials live, give them the least access possible, replace long-lived secrets where you can, and assume that anything once public is no longer private.

Want this done properly? See our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Microsoft Threat Intelligence, November 5, 2026; Microsoft on Storm-0940 and ARTEX; Microsoft on Storm-3358 and ARTEX; Wiz on ARTEX; GitHub secret scanning documentation; Microsoft Learn on Conditional Access for workload identities.