ARTEX / Exposed Secrets - GitHub Queries for Secrets → Service Principal Sign-Ins Across Tenants → Resource Manager, Then Key Vault → SharePoint and Mailbox Collection → MSP Client Tenants → AI Keys
Microsoft Threat Intelligence and Microsoft Security Research published this account on November 5, 2026. From August, Microsoft observed an agentic AI offensive framework submitting large volumes of GitHub queries for secrets, often naming a target organization, and it links that scanning to ARTEX. In at least one case, Microsoft says, an agent went from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes, and it gives no step timings or victim for that case. In a follow-on attack from as early as October 28, valid application credentials were used to sign in as service principals across multiple tenants, mostly from 199.19.77[.]84, and to call Azure operations that return credentials, read Key Vault secrets and download SharePoint and OneDrive files. Todyl, whose MXDR team monitors its MSP partners, reported the same address on November 3: more than 33 of about 45 targeted apps authenticated, and the actor reached 27 organizations, including MSPs' clients. Three caveats belong next to the headline. Where those credentials came from is unresolved, and Todyl's own updates lean two ways. Todyl's November 3 telemetry did not show an AI model directing the activity and pointed to a person steering it, while its November 6 update calls the activity AI-driven tooling acting with little human direction. Microsoft's published evidence for agents is speed and API retries. Microsoft names no actor, and Todyl assesses the activity as unrelated to the ConnectWise Cloud Backup compromise attributed to Storm-0940.
Microsoft says that starting in August 2026 it observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets. The queries often included a target organization's name, keywords for secrets, or a keyword tied to cloud services or to another AI service provider. The secrets sought included credentials, application credentials and API keys for AI inference. Microsoft does not quantify the volume.
Microsoft's own summary of the post says the actors used ARTEX to search GitHub for OAuth application secrets. The body is more guarded: it calls the tool an agentic AI offensive framework and offers ARTEX as an example of tooling that lets actors scan many repositories faster and then have agents analyze the output and carry out follow-on attacks, with less hands-on-keyboard work. Its detection table refers to unattributed network indicators related to ARTEX use and notes that suspected ARTEX use can extend beyond this GitHub scanning. It does not publish those indicators or say how it identified the framework. By default, Microsoft says, ARTEX uses existing tools such as Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright. ARTEX also appears in the Storm-0940 / ConnectWise and VAPOR PANDA / ARTEX kill chains on this site.
Query terms: target organization name, secret keywords, a cloud or AI provider keyword
Sought: credentials, application credentials, AI inference API keys
Volume: described as large, not quantified
Tooling: an agentic framework that Microsoft links to ARTEX
Microsoft describes a follow-on attack, beginning as early as October 28, in which an agentic framework used "valid leaked or stolen application credentials" to reach Entra ID tenants and the Azure and Microsoft 365 services connected to them. Microsoft names ARTEX for the GitHub searching, and as an example of tooling that can carry out follow-on attacks, but its account of this attack says only that an agentic framework was used. The sign-ins came mainly from 199.19.77[.]84 and 199.19.77[.]18, a Tor exit node that Microsoft notes may also carry unrelated malicious traffic, and succeeded for dozens of applications across multiple tenants. An app sign-in raises no MFA prompt, and Conditional Access scoped to users does not apply to it, as Todyl points out.
Todyl first saw the address at 08:45 UTC on November 1. By its November 3 count, about 45 app registrations at roughly 18 organizations were targeted and more than 33 authenticated, using client secrets and, in at least one case, a workload identity federated credential. A failed client-secret attempt and a successful one often appeared for the same app seconds to minutes apart. Scripted clients made 95% of sign-ins, in bursts of up to 24 in 10 seconds. Todyl's figures cover only organizations that send it logs, and it calls them a floor. Its telemetry differs from Microsoft's on the second address. It saw every confirmed app sign-in, download and token replay come from 199.19.77[.]84, and linked 199.19.77[.]18 to the operator only at low to moderate confidence, for Azure CLI password spraying and probing. It tied 65.87.223[.]26 to the same spraying from October 4 to 27, and says every attempt from the two spray addresses failed. Microsoft, which calls 65.87.223[.]26 potentially associated with this campaign, reports shell commands embedded in a user agent and attempts to obtain App Service authentication tokens from it.
Where the credentials came from is unresolved, and Todyl's updates lean different ways. On November 3 it wrote that the origin was unknown: several seed secrets had only ever been used from staff devices and office networks, and some arrived as pairs of a current and an expired secret, which it read as pointing to a file store or live backend and away from configurations crawled from the internet. The same day it listed a tampered Claude Code extension in Cursor's marketplace as a plausible source, without tying any affected organization to an install. On November 6 it called the root cause an agentic credential crawler, citing AbuseIPDB reports of credential scanning from the actor's address before the first sign-in, no sign of prior compromise, and custom-built apps, and it read Microsoft's GitHub finding as confirming the path. It also said that AI agents on the defending side are how many of those credentials got exposed, without publishing the evidence behind that. That update does not address the November 3 evidence. Microsoft leans toward GitHub without settling it for these sign-ins. Its summary says ARTEX was used to search GitHub for OAuth application secrets and that agents then used the compromised applications, and in one case it describes an agent going from searching GitHub for client secrets to Key Vault exfiltration in five minutes. For the sign-ins from October 28, though, it says only that the credentials were leaked or stolen, so Todyl's reading of the GitHub finding as confirmation goes further than Microsoft does.
Source: 199.19.77[.]84; Microsoft also lists 199.19.77[.]18, a Tor exit node that Todyl ties only to password spraying and probing
Microsoft: successful sign-ins on dozens of apps across multiple tenants
Todyl: about 45 apps at about 18 organizations targeted, 33+ authenticated
Client fingerprints unique to the actor (Todyl): task177-f2267/1.0, sait-tenant-deep/37346
Credential origin: unresolved
Todyl saw the same order for nearly every credential: an Azure Resource Manager token, then a Key Vault token, often followed within seconds by Graph, Storage and Cognitive Services tokens. Within minutes, apps that had never been used before started authenticating. Todyl says the timing suggests Key Vault reads were one source of that new material, and that Key Vault audit logs are needed to confirm it. In one case a connector archive was downloaded and the actor signed in as that connector's app about 2.5 minutes later.
Microsoft says the actor targeted operations that return credentials: storage account keys, App Service settings, connection strings and publishing credentials, AI and machine learning connections and datastores, and AKS user credentials. In some cases the agents exfiltrated secrets from the organization's Key Vault. Microsoft also reports that in at least one case an AI agent went from searching GitHub for client secrets to exfiltrating Key Vault data in five minutes. That figure describes one case. Microsoft tells it twice, the second time in its account of the follow-on activity, after describing the same agentic tools obtaining a token for a single-tenant OAuth application in the same target organization. It publishes no step timings or victim, and does not say outright that the case was part of the activity from October 28.
Targeted: storage keys, App Service settings, connection strings, publishing credentials, AKS user credentials (Microsoft)
Pivot: connector archive downloaded, its app signed in about 2.5 minutes later (Todyl)
Five minutes: GitHub search to Key Vault exfiltration, in at least one case (Microsoft)
Microsoft says the actor enumerated subscriptions, resource groups, permissions, AI model deployments and service configurations to map each environment. Against one victim's Resource Manager, from 199.19.77[.]84, it gives three examples of a failed request followed by a corrected one. A batch enumerating Key Vault secret metadata used a data-plane API version against the control plane and returned HTTP 400, and about 28 seconds later a rerun against the same paths with API version 2023-07-01 returned 200. A request for an Azure SQL server's firewall rules failed on an outdated API version, and a matching request about 60 seconds later succeeded with only the api-version parameter changed. An Application Insights query followed the same pattern about 80 seconds apart.
Microsoft calls these sequences consistent with adaptive troubleshooting, and with the five-minute case they are the most specific evidence it publishes for agent behavior. What they show is a client correcting its own API errors within 28 to 80 seconds, and Microsoft publishes nothing that separates an agent from a script or an operator. Todyl's November 3 update held AI direction at low confidence because its telemetry did not show a model directing the activity, and it read multi-hour idle gaps and a switch to spoofed browser signatures as a person steering the tooling. Its November 6 update reads the activity the other way. It calls it an agentic credential crawler, AI-driven tooling that acts with little human direction, and lists the switch to spoofed browser user agents as crawler behavior, without revisiting the idle gaps or its earlier low confidence. For the agentic part it cites Microsoft, writing that Microsoft names the tooling as ARTEX. That goes beyond Microsoft's post, which names ARTEX for the GitHub searching and as an example of such tooling, and says only "an agentic framework" for these sign-ins.
SQL firewall rules: HTTP 400, about 60 s later HTTP 200, only api-version changed
Application Insights query: HTTP 400, about 80 s later HTTP 200
Microsoft's reading: consistent with adaptive troubleshooting
Microsoft says the compromised applications accessed SharePoint and OneDrive, including file downloads and mailbox-item access, and that the actor's Microsoft Graph requests were mostly searches for content of interest. Todyl counted 29 single-wildcard Graph searches across about 25 tenants, followed by bulk SharePoint downloads at about one per second that favored file names such as pass, key and access. Its November 3 totals were 81 files downloaded and about 2,279 mailbox items accessed.
Todyl lists what the collected files held: password lists, private keys, VPN profiles, MFA and RMM API keys, backup-storage credentials, firewall and RDP configurations, Azure environment inventories and service-account maps. It expects them to be used against VPNs, MFA services, RMM and monitoring platforms, backup storage and network devices, exposure it cannot see from Microsoft 365 logs. It saw no extortion demand, encryption or destruction, and says data was accessed.
Downloads: 81 files, about one per second (Todyl)
Mailbox items: about 2,279 accessed (Todyl)
Not seen: extortion demand, encryption or destruction (Todyl)
Todyl says the actor reached 27 organizations through the apps it signed in as, including MSPs' downstream clients in government, energy, legal, education, nonprofits and other sectors. On November 3 a single multi-tenant app swept 15 client tenants in loops of about 10 seconds. One MSP's app obtained a Partner Center token, and the same MSP's GDAP automation app was tried against client tenants without success. Integration apps for security tools were among those abused, including Todyl's own integration apps in two MSP tenants, and Todyl says there is no sign any vendor platform was compromised.
Microsoft describes the same shape from the vendor side: cases where a multitenant application credential was compromised at the source, a vendor-owned application, and used to access multiple downstream tenants. It does not name the vendor.
One app: 15 client tenants in about 10-second loops (Todyl)
Partner Center: a token obtained by one MSP's app (Todyl)
GDAP: automation app tried against clients, without success (Todyl)
Vendor apps: a multitenant credential compromised at the source (Microsoft)
Microsoft says the agents searched Azure DevOps for secrets and used a compromised OAuth application to call Run Command, which runs scripts on Azure VMs. It does not say what ran. Todyl saw an Azure DevOps federated workload identity used from the actor's address from 14:39 UTC on November 1, and two users' Azure DevOps sessions replayed on November 2, the first at 10:39 UTC. Reported PAT use was still being examined.
After detections fired at 07:57 UTC on November 3, the actor switched from curl and Python to spoofed browser user agents. Todyl's last recorded success came at 15:16 UTC. By 18:12 UTC the actor was replaying several users' refresh tokens with scripted clients, and Conditional Access blocked every replay, including its latest attempt at 21:31 UTC. It kept retrying credentials against disabled and rotated apps, and Todyl saw no persistence: no new consents, credentials, roles or users.
VMs: Run Command called through a compromised OAuth app (Microsoft)
Refresh tokens: replayed from 18:12 UTC November 3, all blocked by Conditional Access (Todyl)
Persistence: none seen by Todyl
Microsoft says the agents repeatedly focused on credentials for AI services, such as API keys for major AI providers and OAuth applications with access to Foundry Tools, formerly Azure Cognitive Services. The actor attempted to validate stolen Azure resources, including compromised Azure AI services, and Microsoft says it might have attempted to abuse some of them. Separately, Microsoft observed reconnaissance of AI workloads on Azure AI services from 157.22.126[.]128.
Todyl saw four AI-service tokens issued at two MSPs, three for Cognitive Services and one for Azure ML, and notes that an issued token does not prove use. Its November 6 update adds that one partner was billed thousands of dollars of API usage in about 10 minutes. Todyl says the activity fits either an initial access broker or the resale of LLM API access.
Tokens: four AI-service tokens at two MSPs (Todyl)
Billing: thousands of dollars in about 10 minutes, one partner (Todyl)
Motive: initial access broker or LLM access resale; Todyl says it fits either