AIエージェントがGitHubの流出認証情報を悪用、最短5分でデータを持ち出す

"Searching open code repositories for exposed credentials, secrets, keys, and other authentication material is a well-documented technique that has historically been limited by the time required for human operators to find code repositories, review the data in the repositories, and leverage authentication material for further action." ／ "However, agentic tooling like ARTEX allows threat actors to not only scan for secrets across multiple repositories at a quicker pace but also use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain." — 冒頭の概要より

"Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets." ／ "The queries submitted by the AI framework often included the name of a target organization, keywords for secrets, a keyword linked to cloud services, or a keyword linked to another AI service provider." ／ "As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers" — 「From exposed secrets to cloud compromise」と冒頭の概要より

"In at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes." ／ "Organizations that find their secrets exposed in public repositories must assume that the exposed secrets and associated applications are compromised." — 冒頭の概要と「From exposed secrets to cloud compromise」より

"The agent successfully conducted service principal sign-ins on dozens of associated applications across multiple tenants." ／ "The threat actor targeted operations that return credentials, including storage account keys, App Service settings, connection strings and publishing credentials, AI and machine learning (ML) connections and datastores, and Azure Kubernetes Service (AKS) user credentials." — 「Credential abuse via Entra ID」より

"The compromised applications subsequently accessed SharePoint and OneDrive in the targeted organization tenants, including file downloads and mailbox-item access." ／ "The agents once authenticated have also searched Azure DevOps for secrets." ／ "The agents also used the compromised OAuth application to use the Run Command , which runs scripts in Azure VMs." — 「Credential abuse via Entra ID」と「OAuth application abuse」より

"During this activity, the AI agents repeatedly demonstrated a focus on credentials that provide access to AI services, such as API keys for major AI service providers and OAuth applications with access to Foundry Tools (previously known as Azure Cognitive Services)." ／ "including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants." — 「OAuth application abuse」と冒頭の概要より

"Additionally in this attack the agent’s operations on a victim’s Azure Resource Manager (ARM) instance originating from 199.19.77[.]84 demonstrated sequences consistent with adaptive troubleshooting, where failed cloud API requests were followed by changes to HTTP methods or API versions and subsequent HTTP 200 responses" — 「Cloud API adjustments indicative of adaptive behavior」より

"Approximately 28 seconds after the first failed response, a batch rerun began against the same vault resource paths using the ARM API version 2023-07-01 and returned HTTP 200." ／ "Approximately 60 seconds after that request, a matching GET began using a supported version and subsequently returned HTTP 200." ／ "Approximately 80 seconds after the failed request, another POST began against the same endpoint, specifying a supported API version, and subsequently returned HTTP 200." — 「Cloud API adjustments indicative of adaptive behavior」より

"For example, ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright, among others." ／ "While blocking network traffic with these characteristics will not stop an attack by an AI agent, which will quickly change them, identifying them can alert defenders to the activity." ／ "In Microsoft’s testing, these controls helped reduce the attack traffic reaching real assets and produced high-confidence, attribution-quality signal." — 「Defending against agentic AI attacks」より

"API利用者やAPIトークンには必要最小限の権限のみを付与する" ／ "APIトークンには適切な有効期限を設定し、長期間有効なトークンの使用を避ける" ／ "不要となった、または漏えいが疑われるAPIトークンは速やかに無効化できるようにする"

"In addition to removing the secrets from the code base, affected organizations should immediately rotate any exposed keys or credentials." ／ "Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure." ／ "Push protection can also block supported secrets before they’re pushed." ／ "While storing long-lived application client secrets in code is a common practice, using managed identities for application authentication eliminates the possibility of secret exposure in code, manual processes associated with secret management, and barriers to securely scaling applications." — 対策の節より

"プログラム内に機密情報をハードコードしない。"

"Organizations can reduce exposure by protecting workload identities and secrets, enforcing least privilege, safeguarding recovery resources, and enabling relevant Microsoft Defender for Cloud protections." ／ "Review Entra service principal and non-interactive sign-in logs for 199.19.77[.]84 and 199.19.77[.]18 including failed attempts." ／ "Sign-in errors AADSTS7000215 (invalid secret) or AADSTS7000222 (expired secret) indicate someone holds a credential for your app; a failure followed by a success is urgent." ／ "This can be achieved by setting the ability for users to register apps to “No” and limiting the application developer role to privileged users." — 対策の節と「Detection and hunting」より