CampaignPublished 8 Nov 2026

ARTEX attack

Source Reddit NetSec

Discussion

The ARTEX attack involves an agentic AI framework that autonomously searches public GitHub repositories for exposed secrets such as OAuth application credentials. Once found, these secrets are abused to access and move laterally within Azure and Microsoft 365 cloud environments, sometimes exfiltrating sensitive data within minutes. ARTEX was publicly available on GitHub until early October 2026 and is now actively used by threat actors in opportunistic campaigns targeting cryptocurrency wallets, gaming accounts, and code-signing certificates. The attack leverages automation and AI to operate at machine speed, significantly accelerating credential abuse and cloud tenant compromise.

r/netsec (opens in a new tab)u/Important_Market9610 points0 comments

Has anyone heard of this?

https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

Links cited in the discussion

https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

Impact

The ARTEX attack enables threat actors to quickly gain unauthorized access to cloud environments by exploiting publicly exposed secrets. This access allows lateral movement within Azure and Microsoft 365 tenants, potentially leading to data exfiltration, credential theft, and compromise of sensitive resources such as Azure Key Vault. The automation and AI-driven nature of ARTEX significantly reduce the time from secret exposure to exploitation, increasing the risk and scale of cloud infrastructure breaches. Targets have included financial institutions, customer environments of managed service providers, and software development ecosystems.

Defensive guidance

Microsoft and CERT-IN recommend immediate action on publicly exposed secrets. Organizations should prohibit hardcoded tokens and credentials in source code, deploy automated secret scanning across repositories and CI/CD pipelines, use short-lived and least-privileged access tokens, and rotate all build and deployment credentials regularly. Valid exposed credentials, especially high-privilege OAuth and service principal secrets, must be revoked or rotated immediately. Organizations should assess which credentials remain valid, understand their access scope, and investigate any signs of compromise. Using tools like GitHub Security Audit and GitGuardian can help identify exposed secrets in public and private repositories. Since ARTEX attacks continue despite the framework's removal from GitHub, ongoing vigilance and rapid remediation are critical.

Summary

ARTEX is an agentic penetration testing framework that threat actors have repurposed to autonomously hunt for exposed secrets on public GitHub repositories. Microsoft Threat Intelligence observed ARTEX agents signing in as service principals using leaked OAuth secrets and moving through Azure and Microsoft 365 tenants, achieving data exfiltration from Azure Key Vault in as little as five minutes. The framework was publicly available on GitHub from late July until October 8, 2026, and despite its removal, attacks continue with over a thousand publicly exposed ARTEX instances detected. Campaigns using ARTEX are largely opportunistic with minimal human intervention, targeting cryptocurrency, gaming accounts, and code-signing certificates. The attack exploits the widespread problem of hardcoded secrets in public code, which remain valid for years, enabling rapid and automated cloud infrastructure compromise.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 8 Nov 2026, 01:33 UTC

Technical details

References

Community reviews

Related threats