[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRjiSeGZPTcq617BAMBmmrtBpY4zsPi5_kyk055uRpGo":3},{"article":4,"iocs":53,"watch_terms":67,"solutions":68,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"0f2abbc1-22aa-4032-b787-5c9547c07409","Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Scanning GitHub","hackers-use-artex-ai-to-steal-azure-key-vault-secrets-just-5-minutes-after-scann-7d8d18","Microsoft says threat actors are using an AI tool called ARTEX to find secrets in public GitHub code and use them against cloud accounts. In one case, the AI agent went from searching GitHub to pulling data from Azure Key Vault in only five minutes. ARTEX AI Azure Key Vault secrets Searching public code for […] The post Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Scanning GitHub appeared first on Cyber Security News.","Threat actors are leveraging an AI tool named ARTEX to rapidly scan public GitHub repositories for secrets like API keys and credentials. In a concerning demonstration of speed, an AI agent was able to compromise Azure Key Vault secrets just five minutes after initiating a search on GitHub. This automated process allows attackers to bypass manual checks and exploit exposed information at machine speed, impacting multiple organizations and cloud services.","ARTEX AI tool steals Azure Key Vault secrets from GitHub in minutes.","https:\u002F\u002Fcybersecuritynews.com\u002Fartex-ai-azure-key-vault-secrets\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FARTEX-AI-Azure-Key-Vault-secrets-2.webp","2026-11-09T10:04:55+00:00","2026-11-09T11:00:35.438133+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"AI","technology",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":19},"Azure Key Vault",{"name":29,"type":19},"GitHub","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,61,64],{"type":55,"value":56,"context":57},"ip","199.19.77.84","IP address associated with successful service principal sign-ins.",{"type":55,"value":59,"context":60},"65.87.223.26","IP address showing shell commands in user agent and attempts to get App Service tokens.",{"type":55,"value":62,"context":63},"157.22.126.128","IP address scouting AI workloads on Azure AI services.",{"type":55,"value":65,"context":66},"199.19.77.18","Tor exit node potentially used by attackers.",[24,18,27],{"controls":69,"vendors":149},[70,98,126],{"slug":71,"name":72,"problem":73,"products":74},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[75,82,90],{"vendor_slug":76,"vendor_name":24,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":99,"name":100,"problem":101,"products":102},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":120,"vendor_name":29,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":127,"name":128,"problem":129,"products":130},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[131,136,144],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":132,"product_name":133,"url":134,"description":135},"cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":145,"product_name":146,"url":147,"description":148},"falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",[150],{"slug":76,"name":24,"logo_path":77,"roles":151},[152,153],"reported_by","affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"ai-powered-secret-harvesting-exposes-github-credentials-in-minutes","AI-Powered Secret Harvesting Exposes GitHub Credentials in Minutes","Developers and organizations exposed API keys, credentials, and Azure Key Vault secrets in public GitHub repositories, allowing AI-powered tools like ARTEX to scan, discover, and exploit them in as little as five minutes. The root cause is a configuration failure: sensitive secrets were committed to public source code repositories where they should never reside. This matters because machine-speed automation eliminates the window organizations traditionally relied on to detect and remediate accidental exposures. The impact extends beyond a single account — compromised cloud secrets can cascade into full cloud environment takeovers, data breaches, and supply chain attacks.",[159,160,161,162,163,164,165],"CIS Control 3: Data Protection","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1552: Unsecured Credentials","GDPR Article 32",{"GDPR Article 32":167,"CIS Control 3: Data Protection":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"MITRE ATT&CK T1552: Unsecured Credentials":170,"CIS Control 14: Security Awareness and Skills Training":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"If personal data is accessible through compromised Azure Key Vault secrets, Article 32 requires organizations to implement appropriate technical measures — including access controls and secret management — to ensure data security and prevent unauthorized access.","Secrets and credentials are sensitive data assets; CIS Control 3 requires organizations to identify, classify, and protect sensitive data — which would mandate that credentials never be stored in public repositories.","Exposed secrets in repositories represent a remediable security flaw; SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes to limit adversary exploitation windows.","ARTEX's GitHub scanning directly maps to this technique, where adversaries search public repositories and other sources for exposed credentials to gain unauthorized access to systems and cloud services.","Developers committing secrets to GitHub reflects a gap in secure coding awareness; training on secrets management best practices would reduce the likelihood of accidental credential exposure.","Publicly exposed secrets constitute a known technical vulnerability; A.8.8 requires timely identification and remediation of such vulnerabilities before threat actors can exploit them.","PR.AA requires that credentials and authentication secrets be managed and protected appropriately, which directly addresses the failure to secure API keys and cloud vault secrets from public exposure."]