Threat IntelligenceNov 9, 2026

Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Scanning GitHub

ARTEX AI tool steals Azure Key Vault secrets from GitHub in minutes.

Threat actors are leveraging an AI tool named ARTEX to rapidly scan public GitHub repositories for secrets like API keys and credentials. In a concerning demonstration of speed, an AI agent was able to compromise Azure Key Vault secrets just five minutes after initiating a search on GitHub. This automated process allows attackers to bypass manual checks and exploit exposed information at machine speed, impacting multiple organizations and cloud services.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Microsoft?

Get an email when a new story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Developers and organizations exposed API keys, credentials, and Azure Key Vault secrets in public GitHub repositories, allowing AI-powered tools like ARTEX to scan, discover, and exploit them in as little as five minutes. The root cause is a configuration failure: sensitive secrets were committed to public source code repositories where they should never reside. This matters because machine-speed automation eliminates the window organizations traditionally relied on to detect and remediate accidental exposures. The impact extends beyond a single account — compromised cloud secrets can cascade into full cloud environment takeovers, data breaches, and supply chain attacks.

What helps against this

How we list vendors

Microsoft research, affected

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleMicrosoft Defender for Identity CrowdStrike Falcon Identity Protection Huntress Managed ITDR all options
Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleGitGuardian Secrets Detection Palo Alto Networks Idira Secrets Management GitHub Advanced Security all options
Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
For examplePalo Alto Networks Cortex Cloud Orca Security Orca Cloud Security Platform CrowdStrike Falcon Cloud Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

ip — 199.19.77.84
ip — 65.87.223.26
ip — 157.22.126.128
ip — 199.19.77.18

Entities

ARTEX (product)AI (technology)Microsoft (vendor)Azure Key Vault (product)GitHub (product)