# ARTEX: exposed credentials turn into cloud access

Canonical: https://www.oktsec.com/radar/artex-exposed-secrets-cloud-abuse
Publisher: Oktsec
Language: en
Published: 2026-11-07T12:52:55Z
Updated: 2026-11-07T12:52:55Z
Record reviewed: 2026-11-07T12:52:55Z
Latest evidence check: 2026-11-07T12:52:55Z
Disclosed: 2026-11-05

Microsoft observed attackers using ARTEX to find exposed secrets and abuse application identities, including data theft from Azure Key Vault. A separate report describes financial sector attacks mainly in Southeast Asia.

## Evidence and response priority

- Category: Threat activity
- Oktsec priority: Act now
- Rationale: Microsoft reports successful application credential abuse and data theft. Respond immediately when your organization has exposed credentials; these reports do not establish a local incident.
- Evidence: Research report
- Verification: Single source
- Fix status: Not applicable
- Exposure requirement: Credentials stored with provider
- Vendor: Microsoft
- Products: Microsoft Entra ID, Azure, GitHub repositories

## Research findings

The November 5 investigation documents secret discovery and subsequent access to cloud resources. It is evidence of observed abuse, not a vulnerability in GitHub itself.

The November 6 investigation identifies Storm-3358, a Cambodia based cluster targeting financial organizations mainly in Southeast Asia and some elsewhere. Shared use of ARTEX does not make every activity the same campaign or actor. Neither report establishes victims in Latin America or the Caribbean.

## Recommended response

Revoke exposed credentials, investigate their use and reduce application permissions.

Relevant to: Cloud identity, application security and incident response teams.

## Response checklist

1. **Revoke exposed credentials** — Removing a secret from a repository does not invalidate it. Review service principal sign-ins and resource access.
2. **Reduce what identities can access** — Review application permissions, dependent tenants and credential storage. Prefer managed identities where supported.
3. **Review exposed applications** — The separate Storm-3358 report includes anonymous uploads, SSRF and remote access tools. Review relevant exposed services and investigate persistence.

## Relevance to AI environments

AI tooling accelerates credential discovery and abuse; the underlying access still depends on identities and permissions.

## Sources

- [Microsoft: exposed secrets and cloud access](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/) — Microsoft; Vendor notice; checked 2026-11-07T12:52:55Z
- [Microsoft: Storm-3358 financial sector activity](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/) — Microsoft; Research report; checked 2026-11-07T12:52:55Z

## Editorial record

- 2026-11-07T12:52:55Z: Added vendor scope, corrections and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/artex-exposed-secrets-cloud-abuse) · [Build a response plan](https://www.oktsec.com/radar/artex-exposed-secrets-cloud-abuse#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=artex-exposed-secrets-cloud-abuse&service=exposure_check)
- [AI agent review consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=artex-exposed-secrets-cloud-abuse&service=agent_review)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.