Skip to content
AI Agents Automate Credential Theft from GitHub in Minutes

AI Agents Automate Credential Theft from GitHub in Minutes

First seen 7 Nov 2026, 14:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 7, 2026 at 14:18 UTC
  • •ARTEX framework enables rapid credential theft from GitHub in under five minutes.
  • •99% of corporate access tokens remain valid indefinitely, increasing security risks.
  • •Automation in development environments complicates credential management and oversight.

Microsoft Threat Intelligence reported a campaign utilizing ARTEX, an offensive AI framework, that automates the theft of exposed credentials from public GitHub repositories. The framework scans for sensitive information such as API keys and authentication tokens, executing the entire attack cycle without human intervention. In a documented case, the time from initial scanning to data exfiltration from Azure Key Vault was just five minutes. Concurrently, a report from BlueFlag Security revealed that 99% of access tokens for corporate repositories do not expire, leaving organizations vulnerable to persistent attacks. This lack of credential management allows both human and AI agents to retain access indefinitely, amplifying security risks. The combination of these findings highlights a vulnerability in software development environments, particularly as AI tools become more integrated into workflows.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-28
Microsoft begins tracking ARTEX campaign
Microsoft Threat Intelligence identified a campaign using ARTEX to automate credential theft from GitHub repositories.
Ciberseguridadlatam
2026-11-06
Microsoft reports five-minute credential theft
A documented case showed ARTEX executing credential theft and data exfiltration from Azure Key Vault in five minutes.
Ciberseguridadlatam
2026-11-07
BlueFlag Security releases developer risk report
BlueFlag Security's report revealed that 99% of access tokens to corporate repositories do not expire, creating security vulnerabilities.
Ciberseguridadlatam

More articles in this cluster (2)

Following this threat?

Track Todyl in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

How fast can credentials be stolen?
In documented cases, the ARTEX framework can exfiltrate credentials in as little as five minutes.
What percentage of tokens do not expire?
According to BlueFlag Security, 99% of access tokens for corporate repositories do not expire.
What should organizations do to mitigate this risk?
Organizations should implement regular reviews of access permissions and enforce expiration policies for access tokens.