Agentic Attackers Hunt Your Leaked API Keys and OAuth...

Microsoft and Check Point published separate write-ups this week describing criminals using an agentic AI framework called ARTEX to go looking for secrets that businesses left lying around: API keys, tokens and OAuth credentials sitting in code repositories, config files and old backups. Microsoft also says a financially motivated group it tracks as Storm-3358 started pointing ARTEX at financial-sector targets in October. If you have ever pasted a key into a repo "just for now," the thing that used to take a patient human attacker days can now be run by software that doesn't get bored.

Here's why a small business owner should care this week and not next quarter. The old protection for a forgotten key was obscurity. Nobody was going to read through your two-year-old branches. A tool that reads everything, tries what it finds, and chains one stolen credential into the next removes that protection. Meanwhile, a separate warning about SonicWall SSL-VPN gear shows the front door has the same problem: working attacks are circulating for the devices that sit at the edge of your network.

The good news is that the fix is mostly your own effort and free tools. You can find the secrets before the machine does, rotate the dangerous ones first, and check your firewall. That's a few hours of work for most small shops, and it's the kind that pays off every time.

What happened

Apprised.news's tech and cyber desk covered this over two days, and the analysis in this post comes from those desk briefs, not from my own testing. The November 6 brief and the November 7 brief are the pages to read for the full reasoning.

Two vendors describe the same mechanics. Microsoft published a write-up on threat actors using agentic AI tooling to find and abuse exposed secrets, and Check Point Research published its own look inside ARTEX cybercrime campaigns. The desk notes that two vendors corroborating the mechanics, including harvesting of exposed OAuth secrets, is why it treats the hygiene advice as sound.
It is moving toward finance. Microsoft followed with a post on ARTEX abuse expanding to the financial sector, saying Storm-3358 began using it against financial-sector targets in October 2026. The desk reads this as financially motivated criminal use, not a state program.
The scale is not settled. The desk is explicit that ARTEX's overall scale and how much it depends on a particular AI model rest on single sources, and it wants a second security firm with victim counts before treating the size as established. Treat the scale as provisional. Treat "don't leave keys in code" as settled.
Edge devices are under the same pressure. BleepingComputer reports SonicWall warning of a new SSL-VPN MFA bypass flaw exploited in attacks. The desk says to check whether that flaw and CVE-2026-103039 (CVSS 9.8) show up in CISA's actively exploited list, since that feed was unavailable when the brief was written. Rapid7's Metasploit wrap-up covers unauthenticated remote code execution modules for network perimeter devices, which tells you working exploits for edge gear are public.
A related Linux flaw is on the watch list. CSO Online covers an OpenSSH flaw (CVE-2026-123158) on some musl-based Linux systems that lets attackers reach accounts with passwords disabled. The desk lists patch status as a watch item.
AI-enabled fraud already hits payments. SecurityWeek reports three people charged in a scheme using AI to impersonate CEOs and attorneys to steal $129 million.
A reminder about the AI tools you connect. A community post on OpenAI's forum alleges a tool call was silently routed to a different connector. OpenAI had not responded in the material the desk reviewed, so this is an allegation. It's still a fair prompt to look at which connectors and tokens your AI tools hold.

What it means for a small business

Three kinds of business are most exposed: anyone who has ever put a key in code or a config file, anyone running a VPN or firewall appliance that isn't patched, and anyone who has clicked "Allow" on a lot of OAuth consent screens over the years. If you're in finance, or you sell to finance, assume you're closer to the front of the line.

The common thread is cost. A leaked credential used to need a person to notice it, test it and decide what to do next. An agentic tool does that loop all day. My earlier post on leaked API keys getting used in about two minutes covers the same speed problem from the repo side, and why API keys in your HTML are readable by anyone covers the browser side.

A 12-person bookkeeping firm with keys in an old repo

A contractor pasted a QuickBooks API key and a Stripe restricted key into a private GitHub repo two years ago. The firm runs a scanner across all its repos and config folders and finds 9 secrets in total. Private doesn't mean safe: every past contractor, laptop and integration that ever touched that repo has seen those keys.

They rank the nine by what each can do. Three can move money or read client financial data: the Stripe key, the QuickBooks key and a bank-feed token. Three can send email as the firm. Three are low-risk test keys. They rotate the top three first, which takes about 4 hours including updating the live integrations and testing a payment. They revoke the old keys rather than just creating new ones, because a key that still works is still a key. The remaining six get done over the next week. Total cost is roughly one half-day of one person's time. Compare that with a single fraudulent transfer or a client-data notification letter.

A 40-employee regional lender with a SonicWall SSL-VPN

Fifteen remote staff connect through the VPN. The owner's IT contractor checks the firmware version against SonicWall's advisory, confirms MFA still enforces on the VPN login (not just "turned on" in a settings page), and books a 2-hour patch window.

The arithmetic for the decision: 40 staff at about $400 of revenue per person-day is $16,000 for a full day of downtime. A planned 2-hour window, done early in the morning or on a quiet evening, costs a fraction of that, call it $2,000 if you count it generously at 2 of an 8-hour day across the whole team. An unplanned day lost to an intrusion costs the full $16,000 plus the cleanup, the regulator conversation and the customer trust. Patching is the cheap option by a wide margin, even though it's annoying.

A 6-person ecommerce shop with too many connected apps

The owner has connected ChatGPT and a Zapier-style automation to Google Drive, Shopify and email. Listing every connector and OAuth grant turns up 11. Four of them belong to tools nobody remembers adding, one of them from a free trial a year ago. The owner deletes those four, narrows the scope on three that ask for far more access than the job needs, and shortens token lifetimes where the tool allows it. Time spent: about 90 minutes. The attack surface drops by more than a third, and the grants that remain are ones someone can explain.

What to do this week

Scan every repo for secrets. Run a free scanner such as gitleaks or trufflehog over every repository you own, including old branches and forks, then do a plain folder search for .env, config and backup files on shared drives and laptops. The kit has the commands.
Turn on GitHub secret scanning and push protection for every repo you own, if your plan includes them. This catches the mistake at the moment someone makes it.
Rank every secret by blast radius. Money movement first, then customer data, then email sending, then admin access. Rotate in that order. Revoke the old key, because replacing without revoking leaves the leaked one working.
Audit OAuth grants in Google Workspace, Microsoft 365, Shopify, Slack and any AI tools. Remove apps nobody uses and narrow scopes on the rest.
Check your edge devices. List every firewall, VPN and router. Compare firmware to the vendor advisory, check CISA's known-exploited list, patch SonicWall SSL-VPN, and test that MFA really prompts. The earlier post on patching edge devices and locking admin PCs is a good companion.
Move secrets out of code into a password manager or secrets store, and put a quarterly rotation reminder on the calendar.
Call your bank and payment processor. Tell them which keys you rotated and ask what out-of-band confirmation they require before a new payee is added. The $129 million impersonation case is the reason to ask.
Write a one-page incident plan: who revokes keys, who calls the bank, who talks to customers. A page you wrote on a calm Tuesday beats improvising on a bad Friday.
Check whether your own email and logins already leaked. The free email breach check and the post on checking a leaked password without trusting a random tool cover that side.

Copy-paste prompts

Paste your own redacted data into these. Never paste real secret values into any AI tool.

Use this one to build your first ranked checklist from the tools you actually run:

I run a [type] business with about [number] employees using [list of tools: GitHub, Stripe, QuickBooks, Shopify, Google Workspace]. Build me a prioritized checklist for finding exposed API keys and OAuth secrets, ranked by how much damage each type could do, with the exact order to rotate them. Base it only on the tools I listed. If you're unsure how a specific service handles key revocation, say so and tell me where to check its documentation.

Use this one after a scanner run, with the secret values removed before you paste:

Here is the output of a gitleaks scan with the secret values redacted: [paste]. Group the findings by service, tell me which are most dangerous, and give me step-by-step rotation instructions for each service without breaking my live integrations. Work only from the findings I pasted. If a finding is ambiguous or you can't tell what service it belongs to, say so instead of guessing.

Use this one when you need to explain the risk to a partner or a non-technical manager:

Explain in plain English how an AI agent could take a leaked OAuth token and turn it into access to my accounts, and list 8 specific controls (scopes, expiry, IP restrictions, alerts) a non-technical owner can set this week. Here are the apps I have connected, copied from my own admin console: [paste list]. Tailor the controls to those apps, and flag any control you're not certain exists for a given app.

Use this one before you touch the firewall, ideally with your IT contractor in the room:

I have a SonicWall firewall with SSL-VPN. Here is my current firmware version and model from the admin page: [paste]. Give me a safe step-by-step plan to check that version against the vendor advisory, verify MFA is enforced, apply the vendor patch, and roll back if something breaks, written for an owner working with a part-time IT contractor. Tell me which steps you can't verify without the vendor's current advisory so I look those up myself.

Use this one to turn the whole exercise into a standing routine:

Draft a one-page secrets-and-access policy for a [size] business using these tools: [list]. Cover where secrets may live, who can create them, how often they rotate, what to do when one leaks, and a 30-minute monthly review routine. Use only the tools and roles I've described, and mark any section where you had to assume something so I can correct it.

Download the kit

The kit is a printable checklist and set of worksheets: a secrets inventory with a blast-radius score, a rotation order list, free-tool scan commands for gitleaks and trufflehog, an OAuth grant audit sheet, an edge device patch tracker, a one-page incident plan with a bank call script, a monthly review routine, and the prompts above. Download the kit.

Fact-check notes and sources

Apprised.news tech desk, Nov 7: ARTEX use by Storm-3358 against financial-sector targets, the scale and model-dependence caveat, the SonicWall and CVE-2026-103039 check item, and the OpenAI connector allegation. Apprised.news tech desk 2026-11-07
Apprised.news tech desk, Nov 6: two vendors corroborating ARTEX mechanics and the "exposed-secret hygiene is the actionable item" read. Apprised.news tech desk 2026-11-06
Microsoft, Nov 5: threat actors using agentic AI tooling to find and abuse exposed secrets. Microsoft Security Blog
Microsoft, Nov 6: ARTEX abuse expanding to the financial sector. Microsoft Security Blog
Check Point Research: inside ARTEX cybercrime campaigns. Check Point Research
BleepingComputer: SonicWall SSL-VPN MFA bypass flaw exploited in attacks. BleepingComputer
Rapid7: Metasploit wrap-up on unauthenticated RCE modules for network perimeter devices. Rapid7
CSO Online: OpenSSH flaw affecting password-disabled accounts on some Linux systems. CSO Online
SecurityWeek: three charged in an AI impersonation scheme worth $129 million. SecurityWeek
OpenAI community forum: allegation of a tool call routed to a different connector, unconfirmed by OpenAI in the reviewed material. OpenAI community
Worked examples: the bookkeeping firm, lender and ecommerce shop are hypothetical, and all counts, dollar figures and time estimates are illustrative.

Agentic Attackers Hunt Your Leaked API Keys and OAuth Secrets: Scan First