# Threat actors use agentic AI tooling (ARTEX) to find and abuse exposed secrets in GitHub and Azure

> Microsoft reports unattributed threat actors using the agentic AI offensive framework ARTEX to query GitHub for exposed secrets, then abusing leaked service principal credentials against Entra ID, Azure Key Vault, Microsoft Graph, Azure Resource Manager and OAuth apps. GitHub secret hunting began in August 2026 and successful service principal sign-ins from suspicious infrastructure were observed from October 28, 2026.

- **Published:** 2026-11-06T02:14:27Z
- **Last reviewed:** 2026-11-06T02:14:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5363
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5363.png
- **ID:** TL-2026-5363
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below)

## Description

In a blog published on 2026-11-05, Microsoft describes a campaign in which threat actors use ARTEX, an agentic AI offensive framework, to automate the path from public secret discovery to cloud credential abuse. Beginning in August 2026 the actors submitted large volumes of GitHub queries combining target organization names, secret-related terms, cloud service keywords and AI service provider references to locate exposed credentials. Microsoft does not attribute the activity to a named actor.

On October 28, 2026 Microsoft observed successful service principal sign-ins from suspicious infrastructure across multiple tenants using valid, leaked application credentials. Once authenticated, the framework targeted operations that return sensitive material (storage account keys, App Service settings, connection strings, publishing credentials, AI/ML connections), enumerated subscriptions, resource groups and permissions, performed AI model deployment reconnaissance, extracted Azure Key Vault secrets, accessed SharePoint/OneDrive files and mailbox items, searched content through Microsoft Graph, searched Azure DevOps for secrets, and enumerated Azure SQL firewall rules, Application Insights query endpoints and Azure Backup recovery resources. Follow-on activity included OAuth application abuse for token generation, Run Command execution on Azure virtual machines, and targeting of AKS user credentials.

Microsoft highlights the agentic behavior of the tooling: ARTEX adapts when requests fail, retrying with modified HTTP methods or API versions (for example an Azure Resource Manager API version change after HTTP 400 errors, with retries roughly 28 to 80 seconds later that then returned HTTP 200), and in one observed case progressed from reconnaissance to credential exfiltration in about five minutes. By default ARTEX uses Nmap, curl, wget, Python HTTP clients, the Norma SDK WebFetch and headless Chromium through Playwright, and it can change source IPs, user agents and fingerprints to evade detection.

Context from other public reporting: ARTEX is an open-source, model-agnostic penetration testing harness published on GitHub by an account named Autumn-27, whose developer announced on 2026-10-08 that public updates would stop and the project would become closed source because of misuse. Wiz and Microsoft have separately documented ARTEX use by Storm-0940 against identity providers and a ConnectWise supply chain compromise; the Microsoft post analyzed here does not attribute the GitHub secret-abuse activity to that or any actor, and its IOCs are not shared with the Storm-0940 reporting. Microsoft also references a Todyl report of credential misuse from the same IP infrastructure.

Defenders should treat exposed Azure application credentials as compromised on discovery (removal from a repository is not sufficient; rotate), move workloads from secret-based service principals to managed identities, apply Conditional Access for workload identities, and hunt for service principal sign-ins, Graph and ARM activity and Key Vault access from the listed infrastructure.

## MITRE ATT&CK

- T1593.003 Code Repositories
- T1552.001 Credentials In Files
- T1078.004 Cloud Accounts
- T1555.006 Cloud Secrets Management Stores
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1213.002 Sharepoint
- T1114.002 Remote Email Collection
- T1530 Data from Cloud Storage
- T1651 Cloud Administration Command
- T1090.003 Multi-hop Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX Leaked Service Principal Sign-In from Campaign Infrastructure** (`TL-2026-5363-SPL-001`)

Detects successful Entra ID service principal sign-ins from the Microsoft-listed ARTEX campaign IPs (199.19.77.84, 199.19.77.18 Tor exit, 65.87.223.26, 157.22.126.128) or from any single source IP authenticating as 3+ distinct service principals in one hour (leaked workload-identity credentials replayed across tenants, observed from 2026-10-28).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078.004, T1552.001, T1550.001, T1090.003
- **Data sources:** azure_ad_serviceprincipal_signin_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=azure sourcetype="azure:monitor:aad" category=ServicePrincipalSignInLogs ```TL-2026-5363 ARTEX leaked service principal credential replay```
| eval src_ip='properties.ipAddress', sp_id='properties.servicePrincipalId', sp_name='properties.servicePrincipalName', app_id='properties.appId', resource='properties.resourceDisplayName', err=coalesce('properties.status.errorCode',0)
| where err=0
| eval ioc_hit=if(in(src_ip,"199.19.77.84","199.19.77.18","65.87.223.26","157.22.126.128"),1,0)
| bin _time span=1h
| stats count as signins dc(sp_id) as sp_count values(sp_name) as sp_names values(app_id) as app_ids values(resource) as resources max(ioc_hit) as ioc_hit by _time src_ip
| where ioc_hit=1 OR sp_count>=3
````

### Microsoft KQL

```kql
// TL-2026-5363 ARTEX leaked service principal credential replay
let ioc_ips = dynamic(["199.19.77.84","199.19.77.18","65.87.223.26","157.22.126.128"]);
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == "0"
| summarize SignIns=count(), DistinctSPs=dcount(ServicePrincipalId), SPNames=make_set(ServicePrincipalName, 25), AppIds=make_set(AppId, 25), Resources=make_set(ResourceDisplayName, 25) by IPAddress, bin(TimeGenerated, 1h)
| extend IocIp = IPAddress in (ioc_ips)
| where IocIp or DistinctSPs >= 3
| project TimeGenerated, IPAddress, IocIp, DistinctSPs, SignIns, SPNames, AppIds, Resources
```

### Sigma

```yaml
title: ARTEX Service Principal Sign-In from Campaign Infrastructure
id: 5b1c7a52-3f0e-4c8d-9a41-6d2e8f1b7c01
status: experimental
description: Detects successful Entra ID service principal sign-ins from IP addresses Microsoft attributes to the ARTEX agentic secret-abuse campaign. The multiple-service-principals-per-IP variant is covered in the SPL and KQL forms.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial-access
  - attack.t1078.004
  - attack.credential-access
  - attack.t1552.001
  - attack.defense-evasion
  - attack.t1550.001
  - attack.command-and-control
  - attack.t1090.003
logsource:
  product: azure
  service: serviceprincipalsigninlogs
detection:
  selection_ip:
    IPAddress:
      - '199.19.77.84'
      - '199.19.77.18'
      - '65.87.223.26'
      - '157.22.126.128'
  selection_success:
    ResultType: '0'
  condition: all of selection_*
falsepositives:
  - Authorized penetration tests or red-team activity from the listed addresses
  - Shared Tor or hosting IP space later reassigned to a legitimate tenant workload
level: high

```

**Known false positives:**

- Authorized red-team or pentest traffic from the listed IPs
- Reassigned hosting/Tor IP space now used by a legitimate workload

**Tuning notes:** Keep the IOC list in a lookup/watchlist and refresh from Microsoft/Todyl reporting. Raise or lower the 3-service-principal threshold for multi-tenant CI/CD egress IPs; allowlist known NAT egress of your pipelines. Requires Entra ID ServicePrincipalSignInLogs exported to Splunk (index=azure) or Sentinel.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ARTEX Service Principal Multi-Resource Token Fan-Out (locked: unlock with TL Creds)
- ARTEX Service Principal Calling Secret-Returning ARM Operations (locked: unlock with TL Creds)
- ARTEX Adaptive Retry with Changed API Version After HTTP 400 (locked: unlock with TL Creds)
- ARTEX Default Tooling User Agents on App-Only Microsoft Graph Calls (locked: unlock with TL Creds)
- ARTEX App-Only Graph Mailbox, SharePoint and Content Search Burst (locked: unlock with TL Creds)
- ARTEX Campaign IP Activity Across Entra, Graph and Azure Logs (locked: unlock with TL Creds)
- ARTEX Key Vault Secret Extraction by Service Principal (locked: unlock with TL Creds)
- ARTEX Azure VM Run Command and AKS Credential Retrieval by Service Principal (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 14)

Defanged, TLP:CLEAR.

- IP address: `199.19.77[.]84`
- IP address: `199.19.77[.]18`
- IP address: `65.87.223[.]26`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat actors use agentic AI tooling to find and abuse exposed secrets](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
- [ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (Wiz)](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)
- [China cyber ConnectWise AI (The Record)](https://therecord.media/china-cyber-connectwise-ai)
- [China-linked hackers use ARTEX AI (The Hacker News)](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html)
- [China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants (CSO Online)](https://csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html)
- [Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack (Dark Reading)](https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5363