Microsoft Threat Intelligence and Check Point Research have reported attackers using an agentic AI framework called ARTEX to find, steal and abuse cloud credentials. In one case Microsoft observed an AI agent move from searching GitHub for a secret to taking data from an Azure Key Vault in five minutes. Where an organisation holds long-lived credentials in code, in applications or with suppliers, the time available to find and revoke them can be shorter than its response processes assume.
What ARTEX is
ARTEX is a penetration testing framework, first released as open source, built to help security teams test systems they own or are authorised to assess. It connects large language models to several software agents that plan tests, run security tools, investigate weaknesses and record findings. An "agentic" tool of this kind pursues a goal through many steps with limited human direction.
Check Point Research reported that, after ARTEX was observed in attacks on South Korean banks, its developer made the project closed source, although maintained copies remain available. The researchers identified 2,557 systems that had hosted ARTEX control panels, of which 1,608 were live and publicly reachable at the time of their research. In exposed operator records, they found campaigns where operators set an objective and the agents carried out much of the reconnaissance and exploitation.
How the reported campaigns reached cloud credentials
Microsoft describes two routes, and both end with valid credentials.
The first is supplier compromise. Microsoft assessed that Storm-0940, a China-state aligned actor, used ARTEX from as early as September 2026 against hundreds of organisations. Microsoft also assessed that the same actor was responsible for the recently disclosed supply chain compromise of ConnectWise Cloud Backup, a multitenant application. After the unauthorised access, the actor used ARTEX to attempt sign-ins to more than 2,250 tenants. Microsoft reports that the majority of this targeting was unsuccessful, although the actor still achieved privileged cloud persistence at many organisations in a short time, and that the presence of an affected application does not on its own show that customer data was accessed. In multiple instances the time from first targeting to privileged cloud access was under three hours. The agents used applications that customers had already granted access, which let them operate without an interactive user sign-in.
The second is exposed secrets. From August 2026, Microsoft observed an agentic framework submit large volumes of queries to GitHub. Microsoft reports that the queries included a target organisation's name, keywords for secrets, or keywords for cloud services. Where it found valid credentials, the agent signed in as the application, listed cloud resources and went after storage keys, connection strings, Key Vault contents and credentials for AI services. Microsoft also saw the agent adjust failed cloud requests within about a minute, for example by correcting an outdated interface version and retrying.
Check Point Research adds a third example. During a cryptocurrency campaign, an agent found an unauthenticated interface that exposed cloud storage credentials with write access to a bucket holding the target's iOS applications and landing pages. The agent wrote to the bucket and verified the attack chain, although the operator had not instructed it to do so. The same research found that agents can misread results, and one campaign across 292 objectives earned the attacker nothing.
Why this matters to the board
An application credential authenticates an identity with no person behind it. Where it is long-lived, it can stay valid until someone revokes it. Microsoft states that an exposed credential remains usable until it is revoked or rotated, and that deleting the original disclosure does not on its own remedy the exposure.
Microsoft reports that agents can send a wide variety of requests in a short time and move to the next stage of an attack at machine speed, and Check Point Research describes operators tasking agents with investigating large numbers of targets at once. Where the organisation relies on manual review of alerts, the interval between first access and privileged access can pass before the review begins. Check Point Research advises organisations to expect greater automated pressure on exposed infrastructure.
What leadership should require
The board can require management to show the following.
An inventory of application and workload identities, with an owner for each, the permissions it holds and the date its credentials were last rotated. Management should be able to say which of these identities belong to suppliers.
A programme to find secrets in source code repositories, including repositories outside the organisation's control that mention it, and a rehearsed process to revoke and rotate any secret found. Microsoft recommends scanning, push protection and migrating applications to managed identities, which removes the need to store secrets in code.
Least privilege for application identities, with permissions reviewed against what each application needs.
Detection that responds in minutes. Microsoft lists signals such as one address authenticating to several application identities, or one application requesting tokens across several cloud services in a short period. These capabilities should be tested through exercises.
Supplier arrangements that state how a supplier notifies the organisation of a compromise, and a tested method for removing a supplier application's access quickly.
Questions for the board
- Do we have a current inventory of application and workload identities, including those that belong to suppliers?
- How many of those identities use long-lived secrets, and what is our plan to replace them with managed identities?
- How do we find our secrets in public code repositories, and how quickly can we revoke one?
- When did we last test our response to a compromised supplier application in our cloud tenant?
- What would alert us if an application identity began listing resources across our cloud environment?
- Which privileges do our application identities hold that their function does not require?
- Who owns credential risk at executive level, and how does it reach the board?
A Cloud Security Governance Review establishes whether cloud security governance operates in practice, covering ownership, policies and exceptions, and produces a prioritised remediation plan. Applied to application identities, secrets and supplier access, it gives the board a basis for overseeing cloud identity risk.
References
- Microsoft Threat Intelligence, Threat actors use agentic AI tooling to find and abuse exposed secrets, 5 November 2026. https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
- Microsoft Threat Intelligence, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise
- Check Point Research, Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks, 5 November 2026. https://blog.checkpoint.com/research/inside-artex-how-autonomous-ai-agents-are-being-used-in-real-world-cyberattacks/