Cybersecurity researchers have linked the open-source, AI-driven penetration-testing platform AntiFox to real-world intrusions involving AWS credential theft and access to production secrets. According to Arctic Wolf Labs, Alibaba Cloud systems hosting AntiFox interfaces were associated with malicious activity against internet-facing web services and connected AWS environments, showing how autonomous AI security tools can be abused for offensive operations.
AntiFox is built on ARTEX and uses a planner, worker, and main-agent architecture to carry out penetration-testing engagements. Given an authorized target, it can conduct reconnaissance, discover attack surfaces, exploit weaknesses, capture findings, and generate a report with limited human involvement. The project is publicly available on GitHub and has been forked 251 times and starred 474 times, reflecting growing interest in agentic AI security tooling.
In one observed attack chain, threat actors compromised an internet-facing Microsoft IIS application. Although the exact initial-access vulnerability remains unknown, they used the IIS worker process, w3wp.exe, to create an ASPX web shell and execute operating-system commands. From there, they searched for web.config files and configuration backups, read application settings and database connection strings, enumerated debug and error-log directories, and copied sensitive configuration and log files into a web-accessible upload directory.
The attackers also attempted to connect to an internal production database using credentials extracted from application configuration. In separate incidents, they began with valid AWS credentials obtained through means that have not yet been determined. Using legitimate IAM identities and, in some cases, assumed EC2 roles, they authenticated to AWS APIs and enumerated services including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock.
Most authenticated cross-service requests returned “AccessDenied” errors, but some discovery and secret-access operations succeeded. Researchers observed successful GetSecretValue requests against production secrets, as well as S3 discovery and object operations using a valid AWS identity. The activity demonstrates how a small initial foothold can escalate into broad cloud exposure when credentials, configurations, and permissions are not properly secured.
The incident highlights the growing risk posed by agentic AI frameworks, which can automate reconnaissance, exploitation, credential validation, and post-exploitation at machine speed. AntiFox and ARTEX are among roughly 45 open-source agentic attack frameworks that connect large language models to tools capable of acting autonomously. These systems can assemble attack pipelines at runtime—for example, searching GitHub for exposed secrets, downloading scanners, and passing discovered credentials into subsequent stages of an operation.
Organizations should treat exposed configuration files, hardcoded credentials, and overly broad IAM permissions as urgent risks. Security teams should rotate exposed credentials, restrict public access to sensitive files, enforce least-privilege access, and monitor for unusual AWS API activity—particularly bursts of denied requests followed by successful secret retrieval or S3 operations. As AI-driven tools become more accessible, defenders must assume that attackers can automate not only discovery, but also exploitation, credential theft, and lateral movement across cloud environments.
Read the original article:
AntiFox AI Pentest Tool Linked to AWS Production Secret Theft