ARTEX Agentic AI Attacks: Defending Microsoft 365 Against OAuth Secret Theft and Tenant Compromise

In November 2026, Microsoft Threat Intelligence confirmed a dangerous escalation in cloud attack tradecraft: threat actors are now operationalizing the ARTEX agentic offensive security framework to automate the discovery and exploitation of exposed OAuth application secrets. This is not a theoretical capability. It represents a live, scalable attack vector where autonomous AI agents scan public GitHub repositories for hardcoded credentials, then immediately leverage those secrets to authenticate directly into victim Microsoft 365 tenants and execute malicious actions under legitimate application identities. The blast radius extends from a single exposed secret in a public repo to full tenant-wide persistence, data exfiltration, and lateral movement across cloud resources.

The Threat: Agentic AI Meets Cloud Credential Theft

The ARTEX framework transforms what was once a manual, labor-intensive process into an automated kill chain. Traditional secret scanning involves attackers cloning repositories, running regex patterns, and manually testing credentials. ARTEX agents perform these tasks autonomously at scale, parsing GitHub commits, gists, and public repos for OAuth client secrets tied to Azure AD applications. Once a valid secret is identified, the agent doesn't wait for human operators. It immediately authenticates to the Microsoft identity platform, acquires access tokens, and begins executing actions within the victim tenant using the compromised application's delegated permissions.

This attack path is particularly insidious because it bypasses traditional perimeter defenses. There are no phishing emails, no exploit kits, and no malware droppers. The attacker simply uses legitimate OAuth 2.0 flows with valid credentials that were accidentally committed to public code repositories. From the perspective of Microsoft 365 audit logs, these actions appear as authorized API calls from registered enterprise applications. This is living-off-the-cloud at machine speed.

Technical Analysis: The ARTEX Attack Chain

The attack chain begins with reconnaissance. ARTEX agents scan GitHub's public surface for patterns matching OAuth client secrets, including Azure AD app registration secrets, client credentials, and certificates. Common leakage vectors include configuration files, CI/CD pipeline variables, Terraform state files, and application code committed without proper secret hygiene.

Once a secret is harvested, the agent validates it against Microsoft's OAuth 2.0 token endpoint. If the associated application has been granted permissions in a tenant—whether user-delegated scopes like Mail.Read or application permissions like Directory.ReadWrite.All—the attacker now possesses an authenticated beachhead. The agent then executes post-compromise actions: enumerating directory objects, accessing SharePoint and OneDrive data, sending emails via Microsoft Graph, creating inbox rules for persistence, or escalating privileges by abusing overly permissive application consent grants.

The affected platforms are universal. Any organization with Azure AD app registrations and developers publishing code to GitHub is potentially exposed. The vulnerability isn't in Microsoft's code—it's in the collision between developer secret hygiene failures and the powerful permissions model of modern OAuth applications. Because no software vulnerability is exploited, there is no CVE associated with this campaign. The exploitation status is confirmed active in the wild, with Microsoft observing real-world tenant compromises traced back to ARTEX-driven secret harvesting.

Detection & Response

Detecting this threat requires shifting focus from endpoint artifacts to identity and API telemetry. You are hunting for anomalous OAuth token issuance, suspicious application behavior, and post-authentication actions that deviate from baseline application patterns.

Sigma Rules

YAML

---
title: Suspicious OAuth Token Issuance from Unusual Source
description: Detects OAuth token requests for Azure AD applications originating from IP addresses or geolocations that deviate from established application baselines, potentially indicating compromised client secrets.
status: experimental
author: Security Arsenal
date: 2026/11/05
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    app_display_name: '*'
    sign_in_status: 'Success'
  filter_known_ips:
    ip_address: 'KNOWN_GOOD_IPS'
  condition: selection and not filter_known_ips
falsepositives:
  - Legitimate application deployments from new cloud regions
  - CI/CD pipeline IP changes
level: high
---
title: Azure AD Application Permission Grant Anomaly
description: Detects consent grants or permission changes for OAuth applications that precede or follow suspicious token issuance patterns, a common ARTEX post-compromise behavior.
status: experimental
author: Security Arsenal
date: 2026/11/05
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    activity_display_name|contains:
      - 'Add service principal'
      - 'Add delegated permission grant'
      - 'Add application role assignment'
    initiated_by.user.user_principal_name|contains:
      - 'external'
      - 'unknown'
  condition: selection
falsepositives:
  - Legitimate admin consent workflows
  - DevOps automation service principals
level: medium
---
title: Microsoft Graph API Anomalous Access Pattern
description: Detects OAuth applications performing high-risk Microsoft Graph operations such as bulk email access, directory enumeration, or SharePoint file downloads outside normal business hours or from suspicious user agents.
status: experimental
author: Security Arsenal
date: 2026/11/05
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operation_name|contains:
      - 'Mail.Read'
      - 'Files.Read.All'
      - 'Directory.Read.All'
      - 'Sites.Read.All'
    user_agent|contains:
      - 'python-requests'
      - 'curl'
      - 'ARTEX'
      - 'go-http-client'
  condition: selection
falsepositives:
  - Legitimate custom scripts using Graph API
  - Third-party SaaS integrations
level: high

KQL Hunt Query (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

let suspicious_agents = dynamic(["python-requests", "curl", "ARTEX", "go-http-client", "node-fetch"]);
let high_risk_scopes = dynamic(["Mail.Read", "Mail.ReadWrite", "Files.Read.All", "Sites.Read.All", "Directory.Read.All", "Directory.ReadWrite.All"]);
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where AppDisplayName != ""
| extend UserAgent = tostring(DeviceDetail.browser)
| where UserAgent has_any (suspicious_agents)
| join kind=inner (
    AuditLogs
    | where TimeGenerated > ago(7d)
    | where OperationName has_any (high_risk_scopes)
    | extend AppId = tostring(TargetResources[0].id)
) on $left.AppId == $right.AppId
| project TimeGenerated, AppDisplayName, IPAddress, Location, UserAgent, OperationName, InitiatedBy
| summarize count() by AppDisplayName, IPAddress, UserAgent, bin(TimeGenerated, 1h)
| where count_ > 10

Velociraptor VQL Artifact

VQL — Velociraptor

-- Hunt for OAuth token artifacts and suspicious process execution on endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       token_endpoint
FROM pslist()
WHERE CommandLine =~ 'login.microsoftonline.com|oauth2|client_secret'
   OR Name =~ 'powershell|cmd|python|node'
   OR Exe =~ 'AppData|Temp|Roaming'

Remediation & Hardening Script (PowerShell)

PowerShell

# OAuth Application Security Audit and Remediation Script
# Run with appropriate Graph API permissions: Application.Read.All, Directory.Read.All, Policy.ReadWrite.ApplicationConfiguration

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Application.Read.All,Directory.Read.All,Policy.ReadWrite.ApplicationConfiguration"

# 1. Inventory all app registrations with secrets or certificates
$apps = Get-MgApplication -All
$secretReport = foreach ($app in $apps) {
    foreach ($secret in $app.PasswordCredentials) {
        [PSCustomObject]@{
            DisplayName = $app.DisplayName
            AppId = $app.AppId
            SecretType = "Password"
            StartDate = $secret.StartDateTime
            EndDate = $secret.EndDateTime
            KeyId = $secret.KeyId
        }
    }
    foreach ($cert in $app.KeyCredentials) {
        [PSCustomObject]@{
            DisplayName = $app.DisplayName
            AppId = $app.AppId
            SecretType = "Certificate"
            StartDate = $cert.StartDateTime
            EndDate = $cert.EndDateTime
            KeyId = $cert.KeyId
        }
    }
}
$secretReport | Export-Csv -Path ".\OAuthAppSecrets_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# 2. Identify apps with excessive permissions
$dangerousPermissions = @("Mail.ReadWrite", "Mail.Send", "Files.ReadWrite.All", "Sites.FullControl.All", "Directory.ReadWrite.All", "RoleManagement.ReadWrite.Directory")
$appRoles = foreach ($app in $apps) {
    $sp = Get-MgServicePrincipal -Filter "appId eq '$($app.AppId)'" -ErrorAction SilentlyContinue
    if ($sp) {
        $assignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All
        foreach ($assignment in $assignments) {
            $role = Get-MgServicePrincipalAppRole -ServicePrincipalId $assignment.ResourceId -AppRoleId $assignment.AppRoleId
            [PSCustomObject]@{
                AppName = $app.DisplayName
                AppId = $app.AppId
                Permission = $role.Value
                IsDangerous = $dangerousPermissions -contains $role.Value
            }
        }
    }
}
$appRoles | Where-Object { $_.IsDangerous } | Export-Csv -Path ".\DangerousAppPermissions_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# 3. Rotate secrets for high-risk apps (interactive approval required)
Write-Host "High-risk applications identified. Review CSV exports before rotating secrets." -ForegroundColor Yellow
Write-Host "To rotate a secret, use: Remove-MgApplicationPassword -ApplicationId <ObjectId> -KeyId <KeyId>" -ForegroundColor Cyan

# 4. Enforce secret hygiene policies via Azure Policy (example)
# This creates a policy definition to deny secrets longer than 12 months
$policyDefinition = @"
{
  "mode": "All",
  "policyRule": {
    "if": {
      "field": "Microsoft.KeyVault/vaults/secrets/attributes.expiresOn",
      "greater": "[addDays(utcNow(), 365)]"
    },
    "then": {
      "effect": "deny"
    }
  }
}
"@

# Note: Implement Azure Policy via Azure Portal or ARM templates for Key Vault secret expiration enforcement
Write-Host "Manual step: Implement Azure Policy to enforce Key Vault secret rotation and GitHub secret scanning." -ForegroundColor Green

Disconnect-MgGraph

Remediation Steps

Immediate action is required to reduce your attack surface. There is no patch for this threat because it exploits architectural trust, not software flaws.

Rotate all OAuth application secrets immediately that have been committed to public repositories. Use Microsoft Graph or the Azure portal to invalidate old secrets and generate new ones. Prioritize applications with broad permissions like Directory.Read.All or Mail.ReadWrite.
Enforce secret scanning in your CI/CD pipeline. Enable GitHub Advanced Security secret scanning or integrate tools like Gitleaks, TruffleHog, or Azure DevOps Credential Scanner. Block commits that contain patterns matching Azure AD client secrets, API keys, or certificates.
Audit application consent grants. Review all enterprise applications in your tenant and remove any with unnecessary high-privilege scopes. Implement an admin consent workflow to prevent users from granting permissions to unvetted applications.
Implement conditional access for service principals. Use Azure AD workload identity premium features to enforce location-based or risk-based conditional access policies on service principals, not just user accounts.
Enable Azure AD Identity Protection for workload identities. Configure risk detection policies to flag anomalous sign-in patterns from service principals, such as token issuance from unfamiliar IP addresses or at unusual times.
Adopt managed identities wherever possible. Eliminate long-lived secrets entirely by using Azure Managed Identities, workload identity federation, or certificate-based authentication with short-lived tokens. This removes the credential theft vector entirely.

Microsoft's advisory emphasizes that this is an active campaign, not a proof-of-concept. Organizations must treat OAuth secrets with the same sensitivity as privileged account passwords. The window between secret exposure and tenant compromise is now measured in minutes, not days, thanks to agentic automation.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub