 |
| AI-generated illustration of a robot agent reaching into a glowing cloud server vault and pulling out luminous key-shaped credentials, with a cracked shield. |
On 10 November 2026, security researchers at Arctic Wolf Labs published a report about a shift in how cloud attacks work — and it is the kind of shift that changes who can carry out an attack. Attackers are using AntiFox, an open-source, AI-driven penetration testing platform, to break into internet-facing web servers and Amazon Web Services accounts, automating the chain of actions that used to require a skilled human operator: finding a way in, dropping a web shell, reading configuration files, validating stolen credentials, enumerating dozens of cloud services, and pulling production secrets out of AWS Secrets Manager. In at least one observed intrusion, the attackers cycled through multiple AWS identities and made hundreds of API requests in about half an hour, and in some cases they succeeded — obtaining a production secret, and in a separate incident reading, copying and deleting objects from an S3 bucket. BleepingComputer and The Hacker News both reported the findings on 11 November. AntiFox itself is a legitimate tool, built for defensive penetration testing, and it remains available on GitHub. That is precisely the problem: the same AI agent that helps a security team test its defences can now run the attack by itself. This article explains what AntiFox is, how the campaign works step by step, why it matters beyond the handful of victims named so far, and what defenders should check right now.
AntiFox is an agentic penetration testing platform — software that uses AI agents to plan and carry out the steps of a security test on its own, rather than waiting for a human to tell it what to do next. It was created on GitHub in October 2026 as a fork of ARTEX 0.1.1, another AI pentesting framework, and it has a Chinese-language interface, an AGPL open-source licence, and, as of the report, around 474 stars and 251 forks. It has already been updated to version 2.0, which improves how it documents and reports its findings. The platform describes itself as a multi-agent system that manages the entire engagement lifecycle, from initial reconnaissance to the delivery of actionable reports — which is to say, it does the whole job of a penetration tester, from finding the target to writing up what it found. In the attacks Arctic Wolf observed, the attackers ran self-managed instances of AntiFox hosted on Alibaba Cloud, and the infrastructure hosting those instances was linked to confirmed malicious actions against internet-facing web services and associated AWS environments. According to data from Censys, there were 1,465 hosts running an exposed ARTEX console as of 4 November 2026, most of them in the United States, Hong Kong, China, Japan, Singapore and South Korea. The researchers also note that AntiFox is part of a broader trend: roughly 45 open-source agentic attack frameworks are now circulating, including ARTEX, PentAGI and RedAmon. The campaign is not one tool, it is a category.
As an Amazon Associate, we earn from qualifying purchases.
Prices and savings can change. Check the retailer for the current price.
How the attack works: web shell, credentials, then the whole cloud
The intrusions Arctic Wolf documented follow a consistent chain, and each step is worth understanding because each one is a place where the attack can be stopped. In several cases the entry point was a compromised internet-facing Microsoft IIS application: the w3wp.exe worker process created an ASPX web shell, then ran operating-system commands to read web.config files and database connection strings, and copied configuration and log files into a web-accessible upload folder. The precise vulnerability used to achieve code execution on the IIS server was not identified in the report, and in other attacks the actor started instead with a valid AWS credential obtained through as-yet-undetermined means. From that foothold, the AntiFox-linked infrastructure used valid IAM identities — IAM users and, in some cases, an assumed EC2 role — to make authenticated requests to AWS APIs. The enumeration was broad and systematic: GetCallerIdentity, GetUser, ListUsers, ListRoles, ListPolicies and ListKeys, alongside an attempted Amazon ECR GetAuthorizationToken request, and service discovery across IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB and Amazon Bedrock. In one intrusion, the activity progressed from Secrets Manager enumeration to a successful GetSecretValue request against a production secret. In a separate incident, a valid AWS identity was used to read, copy and delete S3 objects. The pace is the point: in one case the source cycled through several AWS identities and made hundreds of API requests in about 30 minutes, most of them denied, but some succeeding. An AI agent does not get tired, does not pause to think, and does not stop at the first access denied — it moves on to the next permission, the next service, the next identity, until something works.
Why this is different: the automation of the attacker
Security teams have seen tools weaponised before, and the history here is instructive. ARTEX, the framework AntiFox was forked from, went closed-source after it was used in attacks on South Korean banks, and CrowdStrike linked ARTEX to a cyberespionage campaign in which the Chinese hacking group Vapor Panda targeted more than 200 organisations across 14 countries. What is new about AntiFox is not the idea of misusing a pentest tool, but the degree of autonomy. A traditional attack tool waits for instructions; an agentic framework plans its own next step, decides which service to enumerate, and adapts when a request is denied. Arctic Wolf's warning captures the practical consequence: organisations should not assume an attack has failed simply because many API calls were denied, as successful discovery and secret-access operations can appear within the same burst of automated requests. A defender watching CloudTrail logs might see hundreds of AccessDenied errors and conclude the attack was blocked, while the one GetSecretValue that succeeded sits quietly among them. The other difference is the barrier to entry. AntiFox is free, open-source, and available on GitHub, which means the capability it represents is not limited to well-resourced hacking groups. Anyone who can run a server on Alibaba Cloud can deploy an AI agent that performs, in minutes, the reconnaissance and credential abuse that once took a skilled operator hours or days. That is the trend Arctic Wolf is really warning about: the democratisation of the attack, not just the attack itself.
The indicators: what Arctic Wolf published, and what to hunt for
Arctic Wolf's report includes hunting guidance and specific indicators of compromise, which is the most immediately useful part of the disclosure for defenders. The researchers list two Alibaba-hosted source IP addresses, AntiFox's default port TCP/8787, its console title, and Boto3 1.43.125 user agents as indicators, while warning that cloud addresses may be reassigned and should not be treated as permanent. The recommended hunts are behavioural rather than purely indicator-based: correlate IIS web shell activity with unusual AWS access, and review successful API calls that appear within bursts of denied ones, since a successful secret access can hide inside a flood of failures. The report also notes the Censys finding of 1,465 exposed ARTEX consoles, which is a reminder that the infrastructure for these attacks is itself discoverable — the consoles are internet-facing, and their operators are not always careful. For defenders, the practical hunting queries are straightforward: look for GetCallerIdentity and ListUsers calls from unfamiliar sources, look for Secrets Manager GetSecretValue calls that follow enumeration bursts, look for S3 discovery and object operations from identities that do not normally touch S3, and look for w3wp.exe spawning unexpected processes on IIS servers. None of these is proof of AntiFox specifically, and that is the point: the defence is against the behaviour, not the brand name, because the next campaign will use a different framework with the same playbook.
What this means for everyone who runs anything on AWS
The AntiFox campaign matters beyond the organisations already hit, because the pattern it demonstrates applies to any cloud account with a weakness in the same places. The first lesson is about exposed web applications: the intrusions started at internet-facing IIS servers, and the web shell was the foothold for everything that followed. An unpatched or misconfigured web application is not just a website problem; it is a cloud credential problem, because configuration files and connection strings on that server are a direct path to AWS identities. The second lesson is about credential hygiene: in some incidents the attackers started with a valid AWS credential obtained by unknown means, which means the credential was already out there — hard-coded, leaked, over-permissioned, or long-lived — before AntiFox ever touched the account. The third lesson is about permissions: the attackers enumerated dozens of services precisely because the identities they held could reach them, and the successful secret access happened because one identity had permission to read a production secret. Least privilege is the defence that would have limited every step of this campaign. The fourth lesson is about monitoring: the burst pattern, hundreds of requests in thirty minutes with mostly denials, is detectable, but only if someone is looking for successful calls inside the noise of failures. None of this requires new technology to fix. It requires the unglamorous work of patching web servers, rotating credentials, scoping IAM policies, and watching CloudTrail — the same work security teams have been asked to do for years, now with a faster adversary.
Checklist: check your cloud against the AntiFox playbook
- Check internet-facing IIS servers: look for unexpected ASPX files, w3wp.exe spawning shells or command processes, and configuration or log files copied into web-accessible folders.
- Audit AWS credentials: find long-lived access keys, hard-coded credentials in web.config files and connection strings, and rotate anything that has not been rotated recently.
- Review IAM permissions: check which identities can call GetSecretValue on production secrets, and remove access that is broader than the job requires.
- Hunt in CloudTrail: look for bursts of List and Get calls across many services from a single source, and review successful calls that sit inside a burst of AccessDenied errors.
- Check Secrets Manager and S3: look for GetSecretValue calls and S3 read, copy or delete operations from identities that do not normally perform them.
- Check for the published indicators: the two Alibaba-hosted source IPs, traffic to TCP/8787, and Boto3 1.43.125 user agents, remembering that cloud IPs can be reassigned.
- Restrict the console: if you run any pentest or agentic framework yourself, make sure its console is not internet-facing — Censys found 1,465 exposed ARTEX consoles.
- If you use AI pentesting tools in your own security programme, keep them in a controlled environment with scoped credentials, so a tool built for defence cannot become the attacker's tool.
Bottom line
The AntiFox campaign is a warning about what happens when AI agents meet the oldest weaknesses in cloud security. The tool itself is not the villain: it is an open-source penetration testing platform, built for defenders, and it remains available on GitHub for anyone to download. The attackers simply took the defender's tool, hosted it on Alibaba Cloud, and let it run the attack by itself — from a web shell on an IIS server, through hundreds of AWS API calls in half an hour, to a production secret in Secrets Manager. The campaign is small so far, a handful of observed intrusions, but the pattern is what matters: agentic frameworks make the attack faster, more persistent and more accessible, and there are roughly 45 of them in circulation. The defence has not changed, but the urgency has. Patch the web server, rotate the credential, scope the permission, and watch for the successful call hiding inside a burst of failures. The AI agent will not get tired. Your monitoring should not either.
Reference sources
- BleepingComputer, "Hackers use AntiFox AI agents in AWS credential-theft attacks", 11 November 2026
- The Hacker News, "AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets", 11 November 2026
- MLQ, "Attackers use AntiFox, an open-source AI pentest agent run from Alibaba Cloud, to steal AWS secrets, Arctic Wolf says", 11 November 2026
- SecurityBrief, "AntiFox tool drives IIS & AWS attacks, Arctic Wolf warns", 11 November 2026
- GazeWire, "AI Pentesting Tools Linked to AWS Cloud Breaches", 11 November 2026
Leave a public comment