Threat actors use ARTEX agentic AI to identify exposed secrets

Microsoft Threat Intelligence has observed that threat actors are using the agentic offensive security framework named ARTEX. This AI-based tool is used to search GitHub for exposed OAuth application secrets.

The secrets identified through these scans can be exploited to compromise the relative OAuth applications. Once authentication is obtained, attackers have the ability to perform actions within the tenant of the affected application.

Subsequently, the agents operating on behalf of the threat actors use the compromised OAuth applications to carry out various additional activities within the targeted organizations. The process shows how agentic technologies are being repurposed to automate the discovery and abuse of exposed login credentials.