Overview
Microsoft Threat Intelligence has reported a campaign in which threat actors are using agentic AI offensive frameworks to identify and exploit exposed secrets in public GitHub repositories.
The activity involves automated searches for credentials, application secrets, authentication material, and AI inference-related API keys. Once valid secrets are discovered, attackers can use them to access cloud environments and perform additional malicious operations.
Microsoft highlighted the use of an agentic AI framework known as ARTEX. Unlike traditional manual credential discovery, these tools can search multiple repositories, analyze the results, and initiate follow-on attacks with limited human intervention.
In one observed case, an AI agent moved from scanning GitHub repositories for exposed secrets to exfiltrating data from an Azure Key Vault in approximately five minutes.
Attack Methodology
1. Automated discovery of exposed secrets
Beginning in August 2026, Microsoft observed threat actors submitting large volumes of search queries to GitHub through an agentic AI framework.
The queries included:
Target organization names.
Keywords associated with credentials and secrets.
Cloud service-related terms.
Names of AI service providers and related authentication keys.
The objective was to identify publicly exposed credentials that could provide access to organizational applications and cloud resources.
2. Abuse of compromised application credentials
After obtaining exposed or stolen credentials, attackers used them to authenticate to Microsoft Entra ID tenants.
The activity involved service principal sign-ins across multiple applications and affected organizations. In some cases, a compromised multitenant application credential originating from a vendor-owned application was used to access downstream customer tenants.
These credentials provided access to cloud resources according to the permissions assigned to the affected applications.
3. Cloud reconnaissance and credential collection
Once authenticated, the attackers performed reconnaissance across Azure and connected Microsoft 365 environments.
Observed activities included:
Enumerating Azure subscriptions and resource groups.
Discovering application permissions and service configurations.
Accessing Azure Key Vaults and Storage Accounts.
Retrieving storage account keys and application connection strings.
Targeting App Service settings and publishing credentials.
Searching Azure DevOps for additional secrets.
Enumerating AI model deployments and machine-learning connections.
Microsoft also observed attempts to obtain credentials associated with Azure Kubernetes Service and other cloud workloads.
4. Data access and exfiltration
The compromised application identities were used to access sensitive organizational resources.
Microsoft observed activity involving SharePoint and OneDrive, including file downloads and mailbox-item access. Attackers also made Microsoft Graph API requests to search for potentially valuable information.
In some incidents, secrets were exfiltrated from Azure Key Vaults and data was accessed from Storage Accounts.
Observed Campaign Activity
Microsoft reported that follow-on activity involving compromised application credentials began as early as October 28, 2026.
The activity included successful service principal sign-ins from suspicious infrastructure and attempts to access multiple cloud services.
Microsoft also identified adaptive behavior in cloud API operations. Failed requests were followed by attempts using different HTTP methods or supported API versions, eventually producing successful responses.
This demonstrates how automated tooling can adjust its requests and continue interacting with cloud environments when initial operations fail.
Indicators of Compromise (IOCs)
The following IP addresses were identified in Microsoft's investigation:
| Indicator | Description |
|---|---|
199.19.77[.]84 | Observed in service principal sign-ins and cloud resource access |
199.19.77[.]18 | Observed in related sign-in activity; identified as a Tor exit node and may be associated with unrelated activity |
65.87.223[.]26 | Associated with malicious operations, including suspicious user-agent activity and attempts to obtain App Service authentication tokens |
157.22.126[.]128 | Observed conducting reconnaissance against Azure AI workloads |
Note: These indicators are associated with activity described in Microsoft's report. The presence of an IP address in an environment should be investigated alongside authentication events, application activity, and other behavioral evidence.
Impact on Organizations
The campaign creates significant risks for organizations that rely on cloud applications and workload identities.
Potential consequences include:
Unauthorized access to cloud environments.
Exposure of application credentials and API keys.
Compromise of Azure Key Vault secrets.
Unauthorized access to Microsoft 365 data.
Exposure of sensitive files and organizational information.
Compromise of connected applications and downstream tenants.
Persistence through stolen credentials and application identities.
Further compromise of AI services and workloads.
The use of agentic AI can also reduce the time between credential discovery and exploitation, making rapid detection and response increasingly important.
Mitigation and Recommendations
Microsoft recommends that organizations strengthen credential protection and monitor application identity activity.
1. Remove and rotate exposed secrets
Scan public GitHub repositories for exposed credentials.
Immediately revoke or rotate exposed application secrets, API keys, certificates, and storage keys.
Do not assume deleting a secret from a repository makes it safe.
Investigate historical use of exposed credentials.
2. Secure application identities
Apply least-privilege permissions to service principals.
Review application registrations and assigned permissions.
Remove unauthorized credentials and federated identity configurations.
Disable affected service principals when necessary.
Restrict who can register and manage applications.
3. Strengthen cloud monitoring
Review Entra ID service principal and non-interactive sign-in logs.
Monitor suspicious access to Azure Key Vault and Storage Accounts.
Investigate unusual Microsoft Graph API requests.
Review Azure DevOps personal access token creation and usage.
Monitor application activity across multiple cloud services within short periods.
4. Improve authentication practices
Prefer managed identities over long-lived application secrets where supported.
Implement Conditional Access policies for workload identities.
Rotate compromised credentials immediately.
Review OAuth application permissions and authentication configurations.
5. Protect cloud workloads
Enable relevant Microsoft Defender for Cloud protections.
Secure backup and recovery infrastructure.
Monitor changes to application permissions, credentials, and cloud resources.
Use secret-scanning and push-protection capabilities to prevent accidental credential exposure.
Conclusion
The campaign highlights how agentic AI tooling can accelerate credential discovery and cloud compromise. By automating repository searches, analyzing exposed secrets, and performing follow-on cloud operations, attackers can move through multiple stages of an attack chain at machine speed.
Organizations should treat publicly exposed credentials as compromised, rotate affected secrets immediately, and investigate their historical use. Strong workload identity protection, least-privilege access, continuous cloud monitoring, and secure development practices are essential to reducing the risk of AI-assisted credential abuse.