Threat watch / Campaign
AntiFox: an AI pentest agent used to pull production secrets from AWS accounts
Arctic Wolf reports that attackers run self-hosted instances of AntiFox, an open-source agentic penetration testing platform forked from ARTEX 0.1.1, on Alibaba Cloud, and use them for exploitation, webshells and AWS secret harvesting. In one intrusion the attacker used valid AWS identities, cycled through several of them and made hundreds of API requests in about 30 minutes; most were denied, but some succeeded and reached production secrets. AWS says its services "were not compromised and operated as designed" and that the credentials were taken from customers' compromised applications.
- Sector
- Many sectors
- Way in
- Not public yet
- Product or vendor
- AWS, Microsoft IIS
- How it happened
- Attackers drove AntiFox from Alibaba Cloud. In one case they deployed an ASPX webshell on an internet-exposed IIS server, read configuration files and connection strings and copied them to a web-accessible folder; how the webshell got there is not stated. In AWS they used valid identities, IAM users and in some cases assumed EC2 roles, which AWS says came from customers' compromised applications. The reports do not say every AWS intrusion started with a webshell.[1][2][3] Checked 13 Nov 2026
- What was stolen
- Production secrets reached through some successful AWS API calls, plus application settings, database connection strings, configuration and log files. In a separate incident, a valid AWS identity was used to read, copy and delete S3 objects.[1][2][3] Checked 13 Nov 2026
- Who was impacted
- Organizations whose web servers or AWS accounts were reached. The victims, their sectors and their number are not named.[1][3] Checked 13 Nov 2026
- Threat actor
- Not attributed. No named actor. Arctic Wolf says the Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions.
Timeline
- BleepingComputer reports Arctic Wolf's findings on AntiFox, a fork of ARTEX 0.1.1 with a Chinese-language interface, hosted on Alibaba Cloud and used against web servers and AWS accounts. [1]
- GitGuardian publishes its analysis and advises reviewing CloudTrail for successful API calls within bursts of denied requests, revoking AWS sessions and keys, and rotating credentials kept in application config files. [2]
- AWS tells BleepingComputer its services "were not compromised and operated as designed" and that the activity used credentials taken from customers' compromised applications. [1][3]