Attackers Abuse AntiFox AI Pentest Platform to Steal AWS Credentials

Arctic Wolf Labs has published research on attackers using AntiFox, an open-source, Chinese-language agentic penetration testing platform that chains attack steps together with little human effort. In several intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and the AWS environments behind them. Two entry points were observed: a public IIS application, where Arctic Wolf could not identify the vulnerability, and a valid AWS credential obtained by means Arctic Wolf does not know.

In the IIS intrusions, the w3wp.exe worker process created an ASPX web shell and ran commands to gather system information, read the web.config file for database connection details, attempted to reach an internal production database, and copied configuration files and logs into a website-accessible upload folder. In the AWS intrusions, the attackers used valid IAM accounts and, in some cases, an assumed EC2 role, enumerated identities, policies and access keys, and sought an Amazon Elastic Container Registry (ECR) authorization token. Most requests were denied with AccessDenied, but a few succeeded, including a GetSecretValue request against a production secret and S3 object reads, copies and deletions.

Arctic Wolf states that these frameworks make penetration testing techniques easier for attackers to use and make those techniques faster and more consistent in live attacks. Its hunting guidance includes AWS activity from hosting providers the identity has never used, one IP address using many access keys or roles in a short time, and w3wp.exe launching cmd.exe or powershell.exe. Arctic Wolf also warns that a series of mostly denied requests does not mean the attack was unsuccessful.

Why it matters Our reading is that agentic penetration testing frameworks lower the skill and effort needed to chain web exploitation with cloud credential abuse. Security teams should treat a run of denied AWS calls as a warning sign, not as proof of failure. Defenders should review IIS worker processes that spawn shells, watch for new ASPX files in upload folders, and check whether AWS identities are used from hosting networks they have never used before. Investigators should preserve logs and forensic evidence before remediation, and should revoke exposed sessions and access keys.