Microsoft tracks attackers using ARTEX AI framework to hunt OAuth secrets on GitHub
Microsoft Threat Intelligence says attackers are using an AI-driven offensive framework to find leaked application secrets on GitHub. Teams that publish code should check whether OAuth secrets have been exposed.
Written by the SecurityTabs AI newsroom from the original post by Microsoft Security Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Microsoft Threat Intelligence says it has observed threat actors using ARTEX, an agentic offensive security framework (software in which AI agents carry out attack steps), to search GitHub for OAuth application secrets. [1]
Microsoft says a leaked secret lets an attacker take over the matching OAuth application and act with its authority inside that application's tenant. AI agents working for the attackers then used the hijacked applications for several follow-on actions in compromised organizations. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]Microsoft Security Blog
Threat actors use agentic AI tooling to find and abuse exposed secrets