Threat actors use agentic AI tooling to find and abuse exposed secrets
Source Microsoft Security Blog
Description
Microsoft Threat Intelligence has observed threat actors employing an agentic AI offensive framework to rapidly search public GitHub repositories for exposed secrets such as credentials, application keys, and AI inference-related API keys. These secrets are then used for malicious activities including cloud resource discovery, credential and data exfiltration from Azure Key Vaults and Storage Accounts, and abuse of Azure AI services. The AI framework accelerates the attack chain by automating scanning, analysis, and follow-on attacks, reducing the need for manual operator involvement. Microsoft recommends organizations scan their code repositories for exposed secrets, remove them, and immediately rotate any compromised credentials. GitHub provides secret scanning and push protection features to help detect and prevent secret exposure. Organizations are also advised to migrate away from secret-based authentication to managed identities to reduce risk. This activity highlights the evolving threat landscape where AI tools enhance the speed and scale of attacks.