Attackers’ AI agents use leaked app secrets to steal Azure data, Microsoft says
- Vendors
- Microsoft, GitHub
Since August 2026, Microsoft says, attackers have used an agentic AI offensive framework to search public GitHub repositories for exposed secrets, like app credentials and AI service API keys. From as early as Oct 28, it saw agents sign in to organizations’ Entra ID tenants with leaked or stolen app credentials. They took credentials and data from Azure Key Vaults and storage accounts. In some cases, a vendor’s multitenant app credential was compromised at the source and used to reach several customers’ tenants.
The GitHub queries often combined a target organization’s name with keywords for secrets, cloud services or AI providers, Microsoft says. Once signed in as an app’s service principal, the attacker went after operations that return credentials, like storage account keys, connection strings and Kubernetes credentials. The compromised apps downloaded SharePoint and OneDrive files and read mailbox items. Agents also obtained tokens for single-tenant OAuth apps in the same organization, searched Azure DevOps for secrets and used Run Command to run scripts on Azure virtual machines.
Microsoft describes the agent’s cloud API calls as consistent with adaptive troubleshooting. In three cases it shows, a request that failed over a wrong or outdated API version succeeded when retried with a supported one about 28 to 80 seconds later. The agents focused on credentials for AI services, such as API keys and apps with access to Foundry Tools. Microsoft says the attacker may have tried to use compromised Azure AI resources in its wider activity.
Microsoft names no group. It gives ARTEX as an example of the agentic tooling that speeds up secret hunting, and says ARTEX uses tools such as Nmap, curl and headless Chromium by default. Attackers change addresses and user agents quickly, Microsoft warns, so it points to behavior instead, like one address signing in to three or more service principals with mixed success.
Microsoft hasn’t said how many organizations were affected, which vendor’s multitenant app was compromised or how its credential was obtained. It says one of the two sign-in addresses is a Tor exit node that may also carry unrelated traffic.
- Vendors
- Microsoft, GitHub
What to do
8 steps
- 1 Block 199.19.77[.]84/32 as a named location in a Conditional Access policy for workload identities and in a user-scoped block policy, as Microsoft advises.
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Main source of service principal sign-ins from Oct 28, Microsoft says | |
| IP address | Second sign-in source, a Tor exit node that may carry unrelated traffic | |
| IP address | Possibly linked, Microsoft says, with exploit attempts and App Service token requests | |
| IP address | Possibly linked, Microsoft says, with reconnaissance of victims’ Azure AI workloads |
- IP addressMain source of service principal sign-ins from Oct 28, Microsoft says
- IP addressSecond sign-in source, a Tor exit node that may carry unrelated traffic
- IP addressPossibly linked, Microsoft says, with exploit attempts and App Service token requests
- IP addressPossibly linked, Microsoft says, with reconnaissance of victims’ Azure AI workloads
Sources
- Microsoft researchPrimary source microsoft.com