Microsoft says it observed an AI agent move from searching public GitHub repositories for application secrets to exfiltrating data from Azure Key Vault in five minutes. That was one observed incident, not a published performance benchmark for ARTEX or agentic attacks.
The finding appeared in Microsoft Threat Intelligence’s November 5, 2026 report on exposed-secret abuse. A November 6 follow-up described financially motivated attacks by Storm-3358, a Cambodia-based intrusion cluster using ARTEX against financial organizations.
Together, the reports document malicious use of an agentic offensive-security framework across credential theft, exploitation and follow-on access. They do not identify Storm-3358 as the operator behind the five-minute incident.
This is also a different issue from the discovery of exposed ARTEX management consoles. Microsoft’s reports concern attackers using the framework against other organizations.
From a GitHub Secret to Cloud Data
Microsoft describes ARTEX and related agentic tooling searching public repositories for credentials, application secrets and AI inference API keys. The important change is what happens after discovery: agents can analyze the results and carry out subsequent actions, reducing the operator’s need to intervene at each stage.
A conventional secret scanner can identify a suspicious string. An agentic workflow can connect that discovery to credential use, resource enumeration and data collection. According to Microsoft, the observed activity included:
- Searching public GitHub repositories for exposed authentication material.
- Using valid application credentials to access cloud environments.
- Discovering cloud resources and pursuing persistence.
- Exfiltrating credentials and data, including from Azure Key Vault and Storage Accounts.
- Abusing Azure AI services.
An application secret authenticates software as an application identity. In Microsoft Entra environments, service principals represent those applications within tenants. The permissions available to the compromised identity determine what the attacker can reach; finding a secret does not automatically grant access to every resource.
Microsoft reported successful service-principal sign-ins associated with the activity as early as October 28, 2026. Some involved a compromised credential belonging to a vendor-owned multitenant application, which attackers used to access downstream customer tenants.
That detail expands the investigation beyond an organization’s own repositories. A customer may need to review application activity even when the exposed credential belonged to a software supplier.
What the Five-Minute Figure Actually Measures
The reported interval runs from GitHub scanning to Key Vault data exfiltration. Microsoft does not say how long the secret had already been public. It also does not disclose affected-organization totals, exfiltrated data volumes or an overall success rate. These findings come from Microsoft’s telemetry and analysis, without independent verification in the supplied evidence.
The practical implication is still clear: a scheduled scan followed by a manual remediation ticket can be too slow for an attack sequence measured in minutes. That is an inference from the reported timing, not a separate Microsoft measurement.
I’d prioritize preventing publication and shortening the path from exposure detection to credential rotation. Periodic rotation alone leaves an attacker a usable window between discovery and the next scheduled change.
Storm-3358 Combines ARTEX With Familiar Intrusion Tools
Microsoft says Storm-3358 began using ARTEX against financial organizations in October 2026. The cluster primarily targets Southeast Asia, with a smaller number of large financial organizations elsewhere.
The November 6 report describes a mixture of agentic tooling and conventional automated attacks:
| Attack component | What Microsoft observed |
|---|---|
| Internet-facing reconnaissance | ARTEX and other automated tools scanning publicly reachable systems. |
| Vulnerability exploitation | Abuse of weaknesses including anonymous file upload and server-side request forgery, or SSRF. |
| Persistent server access | Web shells on compromised web servers. |
| Credential abuse | Credentials obtained from public sources and compromised systems, followed by cloud-identity abuse. |
| Remote access | WISP, vshell and AdaptixC2 remote-access tools used for persistence and lateral movement. |
Anonymous file-upload weaknesses can let unauthenticated attackers place files on a server. SSRF lets an attacker induce a vulnerable server to make requests, potentially reaching services the attacker cannot contact directly. A web shell provides a way to issue commands through a compromised web application.
Microsoft specifically observed ARTEX agents using utilities such as netcat and curl to download remote-access tools onto compromised systems. It also described recent ARTEX-related activity involving password attacks, API enumeration and database dumping.
Defenders should not expect every agent-driven intrusion to arrive with a novel payload. Much of the visible activity can look familiar: command-line downloads, web requests, application sign-ins and remote-access software.
My read of the evidence is that ARTEX’s consequential role is coordination. It can connect familiar techniques and act on their results with fewer pauses for a human operator. That makes existing controls against exposed services, excessive privileges and malicious downloads highly relevant.
Controls That Interrupt the Reported Attack Chain
Microsoft’s two reports provide mitigation guidance, detection coverage, hunting queries and indicators of compromise. The most useful response is to map those resources to the points where an attacker moves from discovery to access.
| Control area | Microsoft’s guidance | Practical effect |
|---|---|---|
| Exposed application secrets | Find exposed credentials, remove them from code and immediately rotate affected keys or secrets. | Stops continued authentication with the exposed credential once it is invalidated. |
| Secret prevention and monitoring | Use secret scanning, supported push protection and public monitoring for leaks beyond repositories the organization owns. | Catches exposure earlier and can prevent supported secrets from being published. |
| Workload identities | Use managed identities where appropriate and enforce least privilege. | Reduces the need to store reusable application secrets and limits reachable resources. |
| Access policies | Review applicable Conditional Access and identity-risk protections. | Adds access restrictions and risk-based controls where supported and configured. |
| Application investigations | Review service-principal sign-ins and follow-on resource activity. | Helps identify use of compromised application credentials, including supplier-owned applications. |
| Detection and hunting | Use the reports’ Defender coverage, hunting guidance and IOC lists. | Gives security teams concrete starting points for investigation. |
| Defensive deception | Consider decoys, honeypots, tarpits and fake-success surfaces. | Can divert or delay agents and generate investigation signals. |
Rotate the Credential, Then Investigate Its Use
Deleting a secret from a repository does not invalidate a copy an attacker already obtained. Microsoft explicitly recommends rotation in addition to removal.
For a confirmed exposure, the investigation should connect the affected application identity to its sign-ins and resource access. The questions are specific: Was the credential used? Which tenants and resources were reached? What data or additional credentials could that identity access?
Managed identities address part of the underlying problem by allowing supported workloads to authenticate without developers embedding an application secret in code. Permissions still matter. Replacing a stored secret does not make an overprivileged identity safe.
Frequently Asked Questions
3 questions
1Does Deleting a GitHub Secret Stop Its Abuse?
No. An attacker may already have copied it. Microsoft recommends immediately rotating exposed credentials as well as removing them from code.
