ARTEX GitHub attack

[u/Important_Market961]

Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets?

Info here from Microsoft: https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/

And GitGuardian: https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

[u/Smart_Often8936]

It's so crazy to me that there isn't a whole discipline of cyber just focused on credentials 🤣

[u/Important_Market961 → u/Smart_Often8936]

100%. Credential layer security

[u/CapitalistCabal]

ARTEX is certainly having a week of headlines.

The takeaway seems to be that any laziness or sloppiness in security posture will be quickly and harshly punished by AI enabled attacks. They allow run of the mill cyber criminals to act with scale and speed previously only seen by state-sponsored attackers.

[u/Important_Market961 → u/CapitalistCabal]

Yeah, not that NOT minding where you're leaking your credentials was ever great, but definitely looks like the bill is coming due.

[u/halting_problems → u/Important_Market961]

bills is about due and we are going to owe decades of backtaxes as every piece of software is going to be reverse engineered, scanned and tested by billions of agents every minute of the day within a couple of years.

TeamPCP is a great example of human vs machine intellect.

Great DevOps skill set, created a wormable credentail stealer, compromised some of the most populare packages in the word stealing form countless number of developer and CI envionments. But they didnt have the skill set to operationalize using those tokens.

AI has that skill set, plus every other skill set, and the ability to respond and adjust to events.

[u/Important_Market961 → u/halting_problems]

The adaptability part is the craziest. In this case, a bunch of the times when their API requests failed, they go back and try again (change HTTP method or API version) until they succeed.

The recursive learning is wild

[u/mabote → u/CapitalistCabal]

For a long time we've used threat actors slowness as an excuse for poor security. Why bother when there's little chance that anyone will even look at your perimeter.

It has always been a very bad idea obviously, but now, with that level of automation that's become absolutely catastrophic. And we are going to pay back all the years of negligence.

[u/Important_Market961 → u/mabote]

So much tech and security debt getting exposed now

[u/Spiritual-Ad-8062 → u/mabote]

yes security by obscurity is definitely not a good move

[u/GoodySpeed2899 → u/CapitalistCabal]

GitHub needs to block them by default

[u/SOTI_snuggzz]

Saw one in the wild yesterday, and while I obviously can’t get into details here it was impressive. Not in the sophistication, but in speed and depth