[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCHHPRpWtWEv0B4gFQK46XXObnkZ4MSMcRqD8l0b25rg":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b80da3df-1365-4b50-b8a2-3ab2c9ea14d8","Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes","hackers-use-artex-ai-to-find-github-secrets-and-steal-azure-key-vault-data-in-ju-3a4175","Hackers are using the ARTEX AI framework to find exposed credentials on GitHub and turn them into access to cloud systems. In one observed case, an AI agent moved from searching public repositories for application secrets to stealing data from Azure Key Vault in just five minutes, showing how quickly a coding mistake can become […] The post Hackers Use ARTEX AI to Find GitHub Secrets and Steal Azure Key Vault Data in Just 5 Minutes appeared first on Cyber Security News.","Hackers are leveraging the ARTEX AI framework to automate the discovery of exposed credentials on GitHub, rapidly escalating to compromise cloud systems. In a documented instance, an AI agent transitioned from scanning public repositories for secrets to exfiltrating data from Azure Key Vault within five minutes. This sophisticated approach combines credential hunting with automated analysis, enabling attackers to exploit coding mistakes and pursue valuable cloud resources with minimal human intervention.","Hackers use ARTEX AI to find GitHub secrets and steal Azure Key Vault data in 5 minutes.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-artex-ai\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-ARTEX-AI-to-Find-GitHub-Secrets-and-Steal-Azure-Key-Vault-Data-in-Just-5-Minutes.webp","2026-11-06T12:08:58+00:00","2026-11-06T13:00:35.339063+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Azure Key Vault","product",{"name":21,"type":19},"Microsoft Entra ID",{"name":23,"type":19},"Azure DevOps",{"name":25,"type":19},"Azure Kubernetes Service",{"name":27,"type":19},"SharePoint",{"name":29,"type":19},"OneDrive","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54],{"type":55,"value":56,"context":57},"malware","ARTEX","Offensive AI framework used by hackers for credential theft and cloud system compromise.",[18,21,23],{"controls":60,"vendors":142},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":91,"name":92,"problem":93,"products":94},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":120,"name":121,"problem":122,"products":123},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":133,"product_name":134,"url":135,"description":136},"cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":138,"product_name":139,"url":140,"description":141},"falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",[143],{"slug":144,"name":145,"logo_path":146,"roles":147},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148,149],"reported_by","affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"ai-powered-credential-harvesting-turns-github-mistakes-into-cloud-breaches-in-minutes","AI-Powered Credential Harvesting Turns GitHub Mistakes into Cloud Breaches in Minutes","Developers inadvertently committing secrets—API keys, tokens, and credentials—to public GitHub repositories has long been a known risk, but AI frameworks like ARTEX dramatically compress the time attackers need to weaponize those mistakes. In this incident, an AI agent autonomously chained credential discovery on GitHub directly to Azure Key Vault exfiltration in under five minutes, with minimal human intervention. This matters because the attack surface is not a novel vulnerability but a persistent misconfiguration habit, meaning defenders are racing against automation they cannot match manually. Organizations that treat secret management as a developer convenience issue rather than a critical security control will continue to lose this race.",[155,156,157,158,159,160,161],"CIS Control 3: Data Protection","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1552: Unsecured Credentials","CIS Control 14: Security Awareness and Skills Training","GDPR Article 32",{"GDPR Article 32":163,"CIS Control 3: Data Protection":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"MITRE ATT&CK T1552: Unsecured Credentials":166,"CIS Control 14: Security Awareness and Skills Training":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"If exfiltrated Key Vault data includes personal data, the failure to implement appropriate technical measures—such as secret scanning and access controls—constitutes a breach of the obligation under Article 32 to ensure security appropriate to the risk.","Secrets and credentials stored in public repositories represent unprotected sensitive data; CIS Control 3 requires identifying, classifying, and securing sensitive data assets, which would mandate secrets never reside in source control.","While not a software flaw, the persistent misconfiguration of committing secrets to public repos is an organisational control failure; SI-2's principle of identifying and remediating weaknesses applies to remediating developer practices that create recurring exposure.","ARTEX specifically targets unsecured credentials in public code repositories, a technique explicitly mapped under T1552 (Credentials in Files\u002FCode Repositories), which highlights the need for detective and preventive controls around secret exposure.","The root human failure is developers not understanding the consequences of committing secrets; CIS Control 14 requires role-based security training that would include secure coding practices covering credential and secret management.","Exposed credentials in public repositories constitute a known, scannable technical vulnerability; A.8.8 requires organisations to systematically identify and remediate such vulnerabilities before they can be exploited.","The attack succeeded because stolen credentials granted direct access to Azure Key Vault; PR.AA requires that identities be managed and access be tightly controlled so that exposed credentials cannot be trivially leveraged against cloud resources."]