AntiFox AI pentest tool tied to AWS secret theft
Original title: AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
Arctic Wolf says attackers used AntiFox after web shells and valid AWS credentials, including a successful production GetSecretValue call.
Arctic Wolf Labs told The Hacker News that Alibaba Cloud systems hosting AntiFox interfaces were linked to attacks on internet-facing web services and AWS environments. On one IIS server, activity through w3wp.exe created an ASPX web shell, read configuration and logs, and tried an internal database login with an extracted credential. In other cases valid AWS identities enumerated many services; some secret-access and S3 operations succeeded, including GetSecretValue on a production secret. The IIS vulnerability and how some AWS credentials were first obtained are not known.
Unconfirmed: The IIS vulnerability and the origin of some AWS credentials are not identified.
- AntiFox is a GitHub agentic pentest project with 474 stars and 251 forks.
- Successful calls included GetSecretValue against a production secret.
- Censys counted 1,465 exposed ARTEX consoles as of November 4, 2026.
- Check Point reported 2,557 ARTEX hosts, 10 with full databases exposed.
- VECERT's Operation Ghost-Campus claim covers data on over 5,000 students.
Impact: AWS production secrets and application configuration accessed
- 1.Review AWS identities for unexpected enumeration and GetSecretValue calls.
- 2.Check IIS hosts for ASPX web shells created via w3wp.exe.
- ATT&CK
- T1505.003 Web ShellT1059.001 PowerShellT1552.001 Credentials In FilesT1580 Cloud Infrastructure Discovery
- Organizations
- Arctic Wolf LabsVECERTCheck Point ResearchCensys
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fofa.info | ndustrializes the creation of accounts on the search engine fofa.info, scans the global cyberspace for misconfigured servers, ext |
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.