Microsoft Threat Intelligence and Microsoft Security Research said in a blog post dated 5 November 2026 that threat actors are using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including application credentials and AI inference API keys, and then use them against the affected organisations; Microsoft names ARTEX as an example of such tooling and says it saw the GitHub queries starting in August 2026.

Microsoft says that in one follow-on attack, beginning as early as 28 October 2026, an agentic framework used valid leaked or stolen application credentials to sign in to Microsoft Entra ID tenants of certain organisations, mainly from 199.19.77[.]84 and 199.19.77[.]18 (the latter a Tor exit node, which Microsoft says may also carry unrelated activity), and successfully completed service principal sign-ins on dozens of applications across multiple tenants, including cases where a vendor-owned multitenant application credential was used to reach downstream tenants.

Microsoft says the actor went after operations that return credentials (storage account keys, App Service settings, connection strings, AKS user credentials), downloaded files from SharePoint and OneDrive, accessed mailbox items, exfiltrated secrets from Azure Key Vault in some cases and used Run Command on Azure VMs, and that in one case an AI agent went from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes.

Microsoft says a similar campaign involving the same IP addresses was reported by Todyl. Todyl, in an ongoing investigation post first published 3 November and last updated 6 November, says that since 1 November one operator has been signing in to MSPs' Microsoft 365 and Azure environments as their own applications with stolen credentials that are still valid, that about 45 app registrations at roughly 18 organisations were targeted, more than 33 authenticated successfully, and the actor has reached 27 organisations so far.

Microsoft advises scanning code for secrets, rotating any exposed keys or credentials immediately (removing the secret from the repository alone does not fix the exposure), and moving OAuth applications away from secret-based authentication to managed identities. (source: Microsoft Security Blog; Todyl)