Attackers use AntiFox, an Artex variant, against IIS and AWS
Arctic Wolf says the agentic tool planted web shells, ran OS commands, and exposed secrets and S3 data.
68
Malware
AntiFox
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 11, 2026
- Last mentioned3h ago
Timeline
2 articles · newest firstAttackers abuse AntiFox pentest tool against IIS and AWS
Arctic Wolf tied Alibaba-hosted AntiFox interfaces to web shells, config theft, and AWS secret and S3 access.
64
Appears with
- Microsoftvendor · 2
- AWSproduct · 2
- Amazonvendor · 2
- Artexmalware · 1
- A Securityorganization · 1
- Arctic Wolf Labsorganization · 1
- Arctic Wolforganization · 1
- Alibaba Cloudorganization · 1
- IISproduct · 1
- Internet Information Servicesproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.