Actively exploited Security news
ARTEX: attackers let AI agents hunt GitHub secrets and hit financial firms
Microsoft (5 and 6 November 2026) and Check Point (5 November) have described real-world attacks run by the ARTEX agentic AI framework. Agents mine GitHub for leaked keys, go from those to Azure Key Vault secrets within minutes, and the Storm-3358 group has been using them against financial organisations since October. What to look for in your logs and how to defend.
Key points
- ARTEX started life as an open-source Chinese AI penetration-testing platform: language models drive agents that scan, try exploits and log results on their own. Criminals now use it to run attacks with almost no human input.
- Microsoft (5 Nov): since August 2026 agents have searched GitHub for leaked app credentials and AI API keys, and since 28 October have used them to sign in to Entra ID tenants. In one case it took five minutes from finding a secret to exfiltrating Key Vault data.
- Microsoft (6 Nov): Storm-3358, a financially motivated Cambodia-based cluster, has used ARTEX against financial organisations since October, mostly in Southeast Asia – anonymous file upload, SSRF, web shells and the WISP, vshell and AdaptixC2 RATs.
- Update 13 Nov: the FBI issued an advisory, 'Threat Overview of ARTEX Autonomous Penetration Testing Framework', with indicators, and Cisco Talos published an analysis with Snort rules for ARTEX and more than 2,500 ARTEX-linked server IPs.
- Check Point (5 Nov): 1,608 reachable ARTEX panels; ten misconfigured ones revealed near-autonomous campaigns stealing app-signing certificates, attempting crypto theft and harvesting gaming accounts.
What happened
Within two days, three write-ups described real attacks driven by the ARTEX agentic AI framework. Check Point calls it a Chinese open-source penetration-testing platform in which language models coordinate several agents that plan the test, run security tools and record the flaws they find. The developer took the project closed-source in October, but forks remain publicly available.
- Microsoft, 5 Nov: since August 2026 agents have been hunting for leaked secrets on GitHub, and since 28 October they have used them to break into Entra ID tenants and Azure. The actor is not named.
- Microsoft, 6 Nov: Storm-3358, a financially motivated cluster based in Cambodia, has used ARTEX since October against financial organisations, mostly in Southeast Asia, and a smaller number of large financial firms worldwide.
- Check Point, 5 Nov: it found 2,557 systems that host or have hosted an ARTEX panel, 1,608 of them reachable. Ten were misconfigured badly enough to expose their whole database, including operator instructions.
Technical details
GitHub secrets → Azure. The agents fire large volumes of GitHub queries that pair a target organisation's name with secret-related, cloud-service or AI-provider keywords. With the app credentials they find, they sign in to Entra ID as service principals – in one case through a multitenant app whose secret leaked at the vendor. They then call operations that return more secrets (storage account keys, App Service settings, connection strings, AKS credentials), read SharePoint, OneDrive and mailboxes, enumerate Key Vault and use Run Command to execute scripts on VMs. When a call fails because of an outdated API version, the agent retries with the right version 28–80 seconds later. AI service keys are a particular focus.
Storm-3358 against financial firms. ARTEX scans internet-facing systems alongside conventional automated tools and exploits issues such as anonymous file upload and SSRF. Netcat and curl pull down the WISP, vshell and AdaptixC2 RATs, and web shells are left on compromised web servers. The group also uses leaked credentials, password spraying, API enumeration and database dumping. ARTEX's default tooling includes Nmap, curl, wget, Python HTTP clients and headless Chromium via Playwright.
Campaigns from exposed databases (Check Point). Operators set a goal and then mostly just checked progress. One campaign from 14 to 29 October hit ten iOS app-signing shops and collected more than 300 certificates with passwords, three of which passed usability checks. An attempt to drain cryptocurrency from 292 payment domains left the attacker's wallet empty – some of the agents' "successes" were hallucinated. A third campaign against gaming account markets found a file with about 190,000 credential sets. DeepSeek models were the most common choice.
Who is affected
Mainly organisations on Microsoft Entra ID and Azure whose app secrets have ever reached public code, and operators of internet-facing web apps and APIs with weak authentication. Storm-3358 targets the financial sector. Microsoft also flags MSPs: a compromised provider can open the door to its customers.
How to tell if you were compromised
IP addresses published by Microsoft and Check Point (defanged). For one address Microsoft's Sentinel query uses 178.15.54.129 while its table lists 178.16.54.129 – check both. Microsoft notes that 199.19.77.18 is a Tor exit node and may carry unrelated traffic.
199.19.77[.]84
199.19.77[.]18
65.87.223[.]26
157.22.126[.]128
199.19.95[.]66
199.19.95[.]67
199.19.95[.]68
91.92.240[.]238
85.11.168[.]45
85.11.167[.]52
178.16.54[.]129
31.77.229[.]35ARTEX server ranges listed by Check Point:
38.11.173[.]1-125
38.11.221[.]1-125
198.200.59[.]85-89
103.122.245[.]194, 198, 199, 204, 214-219
192.236.172[.]197
198.44.123[.]66
204.44.66[.]81
104.168.112[.]237What else to hunt for:
- service principal and non-interactive sign-ins from these addresses, including failures – Microsoft says a failure followed by a success is urgent,
- one address authenticating to several service principals, or one app requesting tokens for several services in a short window,
- Key Vault secret listing, new Azure DevOps PATs, pipeline changes and Run Command on VMs,
- on servers: curl/Netcat downloads, new cron jobs, web shells and port scans with default tool user agents.
Paste log extracts into our IOC extractor – it pulls IPs out of defanged notation too and builds a list for your SIEM, while the data stays in your browser.
What to do
- Revoke exposed secrets. Rotate anything that was ever in a public repo – deleting the file isn't enough. For an affected app, remove all secrets, certificates and federated credentials (including any the attacker added) and rotate everything in any Key Vault it could read.
- Turn on GitHub secret scanning and push protection, and GitHub Advanced Security for Azure DevOps.
- Get secrets out of apps. Move to managed identities where possible, set maximum secret lifetimes and restrict who can register applications.
- Limit service principals to the permissions they need and apply Conditional Access to workload identities (block exact IPs, not whole ASNs).
- Detect behaviour, not just indicators. Machine-speed retries and floods of varied requests give an agent away more reliably than a user agent. Microsoft also recommends decoys and tarpits that slow agents down and produce high-confidence alerts.
- Test and harden exposed systems – agents try known weaknesses at scale (unauthenticated APIs, file upload, default passwords).
Timeline
Updates
- 13 Nov 2026 - The FBI published a technical advisory, Threat Overview of ARTEX Autonomous Penetration Testing Framework, with an accompanying indicator file; it is listed among the advisories on ic3.gov. Cisco Talos released an analysis the same day. Talos says ARTEX was published on GitHub in July 2026 by a developer using the handle Autumn-27. It ships without its own command-and-control server, but its MCP layer lets operators plug in other tools - Talos has seen it deployed alongside VShell, GoPhish and AdaptixC2. Talos counted more than 2,500 IP addresses of ARTEX-linked servers and flags similar platforms (PentAGI - more than 700 reachable instances, HexStrike AI, Hephaestus). It also summarises misuse reported by other firms, including the China-nexus group VAPOR PANDA hitting more than 200 organisations in at least 14 countries (per CrowdStrike).
- Detection: Snort 3 rules for ARTEX are SIDs 7:76, 7:77 and 7:78; Snort 2 rules are 1:67494, 1:67495 and 1:67496. Rules 7:78 and 1:67496 are POLICY rules and disabled by default. Talos's indicators are in its Cisco-Talos/IOCs repository.
- Talos recommendations beyond our list: MFA for remote and privileged access, login rate limiting and alerts on password spraying, EDR tamper protection and sensor health monitoring (Talos says ARTEX has shown it can bypass EDR), independent telemetry, and a rehearsed process for quickly revoking tokens and isolating systems. Treat tool signatures as leads, not your only detection.
- 10 Nov 2026 - first version of this article.
FAQ
Is ARTEX a vulnerability I need to patch?
No. It's an attacker tool, not a product flaw. The agents exploit familiar weaknesses: secrets in code, weak passwords, unauthenticated APIs, anonymous file upload. Defence is hygiene plus behavioural detection, not a single patch.
Is blocking the listed IP addresses enough?
No. Microsoft stresses that an AI agent can change its IP address and user agent in moments. Use the IPs to search for past access, but build detections on behaviour: many varied requests in a short time, machine-speed retries, one address signing in to several service principals.
We deleted the secret from the repo. Are we safe?
No. The file stays in git history and in clones. In Microsoft's words, publicly exposed credentials remain usable until revoked or rotated. Treat any key that was ever public as compromised.
Who is behind the attacks?
Microsoft names Storm-3358 (financially motivated, Cambodia-based) and Storm-0940, and doesn't name the actor in its GitHub secrets report. Check Point describes opportunistic, financially motivated cybercrime and doesn't attribute it to a specific group.
Sources
- Microsoft Security Blog – Threat actors use agentic AI tooling to find and abuse exposed secrets (5 November 2026)
- Microsoft Security Blog – ARTEX abuse expands as cybercriminals target financial sector (6 November 2026)
- FBI (IC3) – Threat Overview of ARTEX Autonomous Penetration Testing Framework (13 November 2026)
- Cisco Talos – ARTEX and beyond: AI-enabled penetration testing platforms (13 November 2026)
- Check Point Research – Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (5 November 2026)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.