Hackers enlist Artex to scan GitHub repositories for exposed secrets

Hackers are using Artex and other agentic AI-based frameworks to scan public GitHub repositories for exposed credentials and API keys, according to a report Thursday from Microsoft Threat Intelligence.

Microsoft researchers said the threat activity overlaps with a campaign using the same IP address, as outlined in research released Wednesday by Todyl.

That report showed how hackers with stolen secrets for Entra ID signed into Microsoft 365 and Azure environments at various managed service providers.

The threat activity follows a series of attacks where hackers exploited Artex and other agentic AI tooling to automate their attacks.

Hackers have applied various agentic frameworks to scan for GitHub secrets since August, according to Microsoft researchers.