Tracing the ARTEX Kill Chain from a Leaked GitHub Commit to Azure Key Vault
Four reports in early November 2026 described ARTEX: a tool used to find live credentials in public GitHub repositories and turn them into cloud access, with one claim of Azure Key Vault data in about five minutes. None of the reports gives an incident date, a mechanism, or an artifact you can inspect, so this video walks the chain as documented Azure and GitHub behavior, in a lab you own. What the video covers: a secret left behind in git history, the pickaxe search over commits and forks that finds it, a single low-noise service principal login that confirms it and leaves a sign-in record, and the one Key Vault read that ends the chain. Then the controls that break each link: scanning history rather than the working tree, keeping secrets out of repositories, scoping what each workload identity can reach, and alerting on service principal sign-ins you didn't expect. Two claims need separating. The 'five minutes' figure has no stated measurement boundary, and most sandbox-escape stories describe an over-permissioned agent with network access rather than an isolation break. Treat ARTEX as a behavior pattern, not a signature. Read the full write-up: https://hackyjs.com/posts/tracing-the-artex-kill-chain-from-a-leaked-github-commit-to-azure-key-vault