A client secret committed to a public GitHub repository used to sit there until a human attacker happened to find it, read the code around it and worked out what it unlocked. Microsoft says that delay is gone. In a report published on November 5, Microsoft Threat Intelligence and Microsoft Security Research describe threat actors using the agentic offensive framework ARTEX to search GitHub for exposed credentials and then act on them, and in at least one case an AI agent moved from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes.
That is the whole attack chain, from discovery to theft, with almost no hands-on-keyboard work by a person. It is the latest in a run of reports on ARTEX, after Google described AI agents running real intrusions in seconds and leaked operator consoles showed the bots doing most of the work.
The queries name the target and the prize
Microsoft says it began seeing the activity in August 2026, when the framework started submitting large volumes of GitHub searches. The queries often combined the name of a target organization with keywords for secrets, a cloud service, or another AI service provider. What the agents were hunting for was application credentials: OAuth client secrets, cloud keys and AI inference API keys.
The danger of an OAuth application secret is that it lets the holder sign in as the application itself (a service principal, the identity an app uses to authenticate) and reach whatever that app is authorized to touch. Microsoft says organizations that find a secret exposed in a public repository must assume both the secret and the application are compromised, because deleting the commit does not revoke the credential.
Dozens of apps, multiple tenants, one IP address
From as early as October 28, 2026, Microsoft observed successful service principal sign-ins from 199[.]19[.]77[.]84 involving multiple application IDs across affected customers. In some cases a multitenant application credential was stolen at the source, from the vendor that owns the app, and then used to reach several downstream customer tenants. The agent signed in on dozens of applications.
Once inside, it went after operations that return more credentials: storage account keys, App Service settings, connection strings, AI and machine learning datastores and Azure Kubernetes Service user credentials. Microsoft also saw SharePoint and OneDrive downloads, mailbox access, Key Vault secret reads, Azure DevOps searches for more secrets, and Run Command used to execute scripts on Azure virtual machines. The agents repeatedly focused on credentials for AI services.
When Key Vault requests failed because the agent used the wrong API version, a corrected batch followed about 28 seconds later and succeeded, a pattern Microsoft describes as consistent with adaptive troubleshooting.
Rotate the secret, then block 199[.]19[.]77[.]84
Microsoft's first advice is to scan your own GitHub code for secrets, remove them and rotate every exposed key immediately, since a leaked credential stays usable until it is revoked. Its longer-term fix is to move OAuth applications off secret-based authentication to managed identities. For containment and hunting it recommends:
- Block 199[.]19[.]77[.]84/32 in a Conditional Access policy for workload identities and in a user-scoped policy. Block the exact IP rather than the whole ASN.
- For affected apps, remove all client secrets, certificates and federated credentials, including any the attacker added, and rotate everything in any Key Vault the app could read. Already-issued tokens stay valid until they expire.
- Review service principal and non-interactive sign-in logs for 199[.]19[.]77[.]84 and 199[.]19[.]77[.]18 (a Tor exit node that may carry unrelated traffic). Errors AADSTS7000215 or AADSTS7000222 mean someone holds a credential for your app, and a failure followed by a success is urgent.
Microsoft also linked 65[.]87[.]223[.]26 (exploitation attempts via shell commands embedded in a user agent, and attempts to obtain App Service tokens) and 157[.]22[.]126[.]128 (reconnaissance against Azure AI workloads) to the campaign, while noting the association is possible rather than certain.
The more interesting recommendation is to fight speed with misdirection. Microsoft says honeypots, tarpits and fake wins, decoys that convince an agent its goal is done, reduced the attack traffic reaching real assets in its testing. An attacker that never tires can still be fooled into stopping.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.