ARTEX: when an application secret opens further cloud access
An exposed secret can carry an application’s authority into other services. Response needs evidence of which access ended and what remains available.
Leggi in portogheseBy Pentesty
Read the case with its dates and limits
In a report published on November 5, 2026, Microsoft describes tools such as ARTEX finding public secrets and using valid application credentials. In one observed case, searching GitHub led to data exfiltration from Azure Key Vault within five minutes. That interval is not an average. The account includes a vendor application’s credentials being used across customer tenants, without establishing data exfiltration in every environment.
Plan revocation and continuity together
Define which operations must stop and which legitimate functions must continue. Agree on a window, change owners and an approved alternative for essential work. The record should distinguish removing the exposed credential, reviewing other associated credentials and the permissions still granted to the identity.
Microsoft warns that tokens already issued remain valid until expiry. Record that period and the controls applicable to the resources, with administrator validation. Evidence that a new authentication attempt was denied answers one question; the reach of existing sessions requires its own verification and decision.
Make the change a verifiable exercise
Use a disposable application, fictional data and a test service within the authorized scope. Before making changes, declare one permitted read and another operation the identity must not perform. Then connect each response to the identity, resource, time and configuration examined. The exercise should produce a comparison another team can review.
With test credentials created for the exercise, confirm the expected result after revocation and continued operation of the approved integration. For previously issued sessions, document validity and the behavior actually observed. A malformed-request failure should not become evidence of an authorization denial. Preserve inconclusive results with an identified next step.
Separate containment from earlier-activity investigation
Build a timeline from available identity and resource records. Distinguish authentication, metadata queries, content reads and permission changes. A successful login alone does not show which data left. If log retention does not cover the relevant period, make that gap explicit to the person deciding the response.
Data and integration owners should assess which other access needs review based on the material actually reached. The discussion of application identities in Microsoft 365 offers a separate context for this work. The cases need not share an operator for a business to examine similar dependencies.
When handing work to another team, pass on unanswered questions too. Identify who will obtain missing records, which services require external confirmation and when assessment resumes. Closing the operational change should not remove those responsibilities from follow-up or imply that investigation is complete.
Close by resource and retain outstanding work
Acceptance should bring together the owner, authorized change, access checks, legitimate function preserved and investigation limits. Identify who follows up on still-valid tokens or an action requiring the supplier. Integrations lacking collected evidence remain on the coverage list with a deadline and owner.
The review of files and secrets in Git complements prevention of further exposure. Repeat the exercise after relevant changes to the application, permissions or supplier. The conclusion should describe observed reach and the validation date, without promising that a single replacement ended every possible access path.
Frequently asked questions
Is five minutes a general intrusion deadline?
No. Microsoft describes one observed case. A business should define its response from the exposure, identity authority and available records.
Does deleting a repository secret complete the response?
Removing content does not demonstrate revocation by the issuer. Connect the credential change with access checks and copies requiring investigation.
Does a denied authentication attempt prove every session ended?
It establishes that attempt’s outcome. Previously issued sessions and tokens need separate assessment against their validity and applicable controls.
Must the test use an exposed credential?
The proposed exercise uses a laboratory application and fictional credentials created for assessment. Investigation of real exposure remains with the responsible team.
Sources and references
Original Pentesty analysis, published November 9, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.