AntiFox AI pentesting agents used in AWS credential-theft attacks
Severity: high · Patch status: no-fix-needed · Since 2026-11-11
Arctic Wolf researchers report attackers self-hosting AntiFox, an open-source Chinese-language agentic penetration-testing platform forked from ARTEX, on Alibaba Cloud to attack internet-facing web services and linked AWS environments. Observed activity includes exploiting vulnerabilities, deploying an ASPX webshell on an exposed IIS server, executing OS commands, harvesting application settings, database connection strings, and configuration/log files, and using valid IAM user credentials and assumed EC2 roles to make hundreds of authenticated AWS API calls in ~30 minutes, obtaining production secrets in some cases and reading, copying, and deleting S3 objects in another incident. AntiFox remains on GitHub (v2.0) with no technical controls enforcing its usage restrictions. Defenders should hunt for webshell activity correlated with anomalous AWS access, revoke exposed sessions/keys, and rotate credentials found in application files.
What to do
- Review AWS CloudTrail for bursts of denied API calls followed by successful ones, and correlate IIS webshell activity with unusual AWS access
- Revoke affected AWS sessions and access keys; rotate credentials exposed in application settings, config, and connection-string files
- Hunt for and remove ASPX webshells on internet-exposed IIS servers; inspect web-accessible directories for copied config/log files
- Restrict EC2 instance roles and IAM permissions; enforce least privilege and short-lived credentials
- Monitor for Alibaba Cloud source IPs interacting with public web endpoints and AWS APIs
Sources
All live incidents on Threat Watch
