AntiFox AI agents used in AWS intrusions exposing production secrets
Arctic Wolf saw an IIS ASPX webshell, hundreds of AWS API calls in about 30 minutes, and S3 read, copy, and delete.
74
Product
Microsoft IIS
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 12, 2026
- Last mentioned13h ago
Timeline
2 articles · newest firstAttackers misuse AntiFox to plant IIS webshells and reach AWS secrets
AWS said its services were not compromised and that stolen customer application credentials were used.
74
Appears with
- Amazon S3product · 2
- ARTEXproduct · 2
- GitGuardianorganization · 2
- Arctic Wolforganization · 2
- Microsoftvendor · 2
- AWSproduct · 2
- AntiFoxproduct · 2
- Amazonvendor · 2
- Amazon Bedrockproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.