AntiFox AI pentest tool tied to AWS secret theft
Arctic Wolf says attackers used AntiFox after web shells and valid AWS credentials, including a successful production GetSecretValue call.
74
Organization
Arctic Wolf Labs
- Mentions · 7d1
- Mentions · 30d3
- All mentions4
- First seenSep 26, 2026
- Last mentioned5h ago
Timeline
4 articles · newest firstFake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
64
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
55
Related CVEs
by mentions- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
Appears with
- Microsoftvendor · 2
- DCRatmalware · 1
- ScreenConnectproduct · 1
- Psychedelic Stealermalware · 1
- Sophosorganization · 1
- Ontinueorganization · 1
- Alibaba Cloudvendor · 1
- AntiFoxproduct · 1
- DeepSeekai model · 1
- VECERTorganization · 1
- RSG_UnityAppmalware · 1
- RegAsm.exeproduct · 1
- Censysorganization · 1
- XWormmalware · 1
- OpenAIai model · 1
- GoGRPCmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.