Hackers Use AntiFox AI Agents To Steal AWS Credentials

Threat actors are running self-hosted copies of AntiFox, an open-source agentic penetration testing platform, on Alibaba Cloud servers to attack web services and AWS environments. Arctic Wolf Labs tracked the activity across several recent intrusions and linked the AntiFox interfaces to confirmed malicious actions against internet-facing systems. The attackers used the platform to exploit web applications, plant webshells, validate stolen credentials, and harvest secrets from AWS accounts belonging to victim organizations.

The campaign shows how attackers now repurpose AI-driven security tools, originally built for research, to automate intrusions at a speed that manual operators rarely achieve. Arctic Wolf warns that agentic frameworks lower the skill barrier for criminals while making each step of an attack faster and more consistent. Defenders therefore now face a growing volume of automated probing that blends successful actions into long streams of failed requests.

AntiFox began as a fork of ARTEX version 0.1.1, an open-source project, whose malicious use has previously been covered here, and its developers maintain it on GitHub under the AntiFox-AI organization. The platform offers a Chinese-language interface by default, although its maintainers also provide Traditional Chinese and English options for users worldwide.

Version 2.0 is currently available on GitHub, and anyone can deploy it through Docker Compose, prebuilt binaries, or a full source build. The developers describe AntiFox as an autonomous platform that handles every stage from reconnaissance to reporting, and its main features include the following:

• A planner agent creates tasks, multiple worker agents execute them, and a main agent lets a human operator step in when needed.
• A global asset graph and a per-task exploration graph track targets, goals, facts, and findings across every testing session the operator runs.

Built-in traffic recording captures every agent request and links each finding to the exact packets that the agents sent and received.
The platform connects to large language models through Anthropic or OpenAI API keys and generates detailed vulnerability reports in Microsoft Word format.

The project README restricts AntiFox to personal study, code research, and local testing within isolated lab environments that never connect to live networks. It explicitly prohibits scanning or attacking real websites, conducting real penetration tests, and engaging in data theft, extortion, or other criminal activity. However, the publishers describe no technical controls to enforce these rules, so nothing prevents a threat actor from directing the agents at real targets.

In some intrusions, the attackers first compromised an internet-facing Microsoft IIS application, although Arctic Wolf could not identify the exact vulnerability they exploited. The IIS worker process, w3wp.exe, then created an ASPX webshell, which the attackers used to run operating system commands directly on the server. They ran commands such as whoami and icacls to learn their privileges and confirm that they could write files into the web root.

Next, the attackers used PowerShell and .NET configuration classes to read web.config files, application settings, and database connection strings from the compromised server. They copied configuration and log files into a web-accessible upload directory, which allowed them to download the stolen data directly from the victim's website. The attackers also tried to connect to an internal production database by using a credential they had extracted from the application configuration.

AntiFox-linked infrastructure then used valid AWS identities, including IAM users and, in some cases, an assumed EC2 role, to make authenticated requests. In one intrusion, the attackers cycled through multiple identities and fired hundreds of API requests across many AWS services within roughly half an hour. AWS denied most of these requests, but several succeeded, and the activity eventually retrieved a production secret through a successful GetSecretValue call.

The automated agents enumerated IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, Amazon Bedrock, and many other services by using List, Get, and Describe operations. After each authorization failure, the agents simply moved on to other services and focused on whatever resources remained accessible. In a separate case, the attackers used a valid AWS identity to list S3 buckets and then read, copy, and delete objects stored in them.

Detection and Mitigation Advice

Arctic Wolf stresses that the sheer number of denied requests can mislead analysts into dismissing the activity as a harmless and unsuccessful scan. In their hunting guidance, the researchers give defenders a blunt warning about this pattern: "Do not assume a sequence was unsuccessful because most requests were denied." Security teams should therefore examine every successful call that appears inside a burst of denials, since these calls reveal what the attackers actually obtained.

Arctic Wolf recommends that organizations take the following steps to detect and contain this type of activity in their own environments:

• Correlate IIS webshell activity, such as w3wp.exe spawning cmd.exe or powershell.exe, with any unusual AWS access that follows shortly afterward.
• Flag single IP addresses that use multiple AWS access keys, IAM users, or assumed roles within a short time window, especially from hosting providers.
• Alert on successful GetSecretValue requests from unfamiliar infrastructure, particularly when broad service enumeration or repeated access-denied errors precede them in CloudTrail logs.
• Revoke active AWS sessions and keys for affected identities, and rotate every credential exposed through web.config files, logs, or backup configurations.
• Enable CloudTrail data events for sensitive S3 buckets, and turn on versioning and Object Lock to limit the damage from unauthorized object deletion.

The researchers also published indicators of compromise, including two Alibaba Cloud IP addresses, the AntiFox web interface title, and the platform's default port, TCP 8787. They note that AntiFox is publicly available and that cloud providers may reassign the IP addresses, so defenders should not treat these indicators as exhaustive.

AntiFox is not the first China-developed agentic pentesting framework that threat actors have turned into a weapon against real organizations and their cloud infrastructure. Its parent project, ARTEX AI, went closed-source after attackers used it against South Korean banks, and CrowdStrike tied ARTEX to the Chinese group Vapor Panda. According to CrowdStrike, Vapor Panda targeted more than 200 organizations across 14 countries, which shows how quickly these tools can scale real-world campaigns.

Amazon has stressed that the attackers did not break into AWS itself but instead abused credentials that they had stolen from compromised customer applications. An Amazon spokesperson later sent BleepingComputer the following statement in response to the Arctic Wolf research on the AntiFox campaign:

AWS services were not compromised and operated as designed. The research describes threat actors using credentials taken from customers' compromised applications to access their AWS accounts. As always, we recommend that all customers follow security, identity, and compliance best practices, including granting least-privilege permissions, requiring IMDSv2 on EC2 instances, keeping long-term access keys out of application configurations, and enabling Amazon GuardDuty. Customers who suspect unauthorized activity in their accounts should follow guidance for remediating potentially compromised credentials or contact AWS Support.

- Amazon spokesperson

The campaign highlights a simple yet costly weakness: long-term AWS access keys that developers store in application configuration files on public-facing servers. Once attackers compromise such a server, AI agents can test every stolen key against dozens of AWS services within minutes and quickly find the gaps. Organizations should audit their internet-facing applications, remove embedded credentials, and enforce least-privilege permissions before automated tools like AntiFox discover those weaknesses first.