What happened

Microsoft Threat Intelligence reports that attackers are running an agentic AI offensive framework to search public GitHub repositories for leaked secrets. Since August 2026 the framework has sent large numbers of GitHub searches that often pair a target organisation's name with keywords for secrets, cloud services or AI providers. It looks for application credentials and AI inference API keys for many applications and cloud services. Microsoft names ARTEX as one such tool and says its agents also review what they find and carry out the follow-on attacks.

In one case an agent moved from searching GitHub to taking data out of Azure Key Vault within five minutes. From 28 October, Microsoft saw successful service principal sign-ins from 199.19.77.84 using several application IDs, in some cases with a vendor's multitenant app credential that reached several downstream tenants. The attacker used that access to map cloud resources and to pull credentials and data from Azure Key Vaults and Storage Accounts.

Microsoft also logged malicious operations from 65.87.223.26 and reconnaissance of Azure AI workloads from 157.22.126.128. It warns that leaked credentials keep working until they are revoked or rotated, even after the original post is removed.

Timeline

  1. Microsoft begins seeing an agentic AI framework send secret-hunting searches to GitHub.[1]

  2. Microsoft starts seeing successful service principal sign-ins from 199.19.77.84.[1]

Who is affected

Organisations whose secrets have appeared in public repositories, which Microsoft says must treat those secrets and the related applications as compromised.

How to check

  1. Scan your code on GitHub to find where secrets are stored.
  2. Turn on GitHub's public monitoring to catch your secrets leaking into other public repositories.
  3. Look through your Entra sign-in records for service principals, including non-interactive and failed sign-ins, from 199.19.77.84 or 199.19.77.18.
  4. Sign-in errors AADSTS7000215 or AADSTS7000222 mean someone holds a credential for your app, and a failure followed by a success needs urgent attention.

What to do

  1. Take secrets out of your code and rotate any exposed keys or credentials straight away.
  2. Treat any credential that was ever public as compromised, even if the file was later edited or deleted.
  3. Move OAuth applications off secret-based authentication.
  4. For affected users, revoke Entra sessions, Azure DevOps personal access tokens and SSH keys.

Indicators of compromise

Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.

TypeIndicatorNoteCopy
IP address199[.]19[.]77[.]84source of the threat actor's service principal sign-ins from 28 October 2026[1]
IP address65[.]87[.]223[.]26source of malicious operations Microsoft ties to the campaign[1]
IP address157[.]22[.]126[.]128source of reconnaissance against AI workloads on Azure AI services[1]

Sources

Changelog

  1. First published.