AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

In several recent intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with malicious actions against internet-facing web services and associated AWS environments, according to Arctic Wolf Labs. The activity involves chaining web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, and secret access.

AntiFox is described as an AI-driven autonomous penetration testing platform available for download from GitHub. As of writing, the project has been forked 251 times and starred 474 times. Unlike most automated pentest tools, AntiFox focuses on delivery—turning AI findings into engineer-readable reports.

Attack Methodology

Arctic Wolf reports that some initial access activity is associated with compromised internet-facing Internet Information Services (IIS) applications. Attackers leverage this access to create an ASPX web shell using "w3wp.exe," the IIS worker process, and run PowerShell commands to locate web.config files, read application settings, and enumerate directories.

The compromised IIS server allows attackers to identify execution context, enumerate the application directory, check permissions, and test file writing capabilities. In other attacks, threat actors start with valid AWS credentials obtained through undetermined means, abusing IAM identities to validate credentials and enumerate numerous AWS services.

While most authenticated cross-service API requests result in "AccessDenied" errors, some discovery and secret-access operations succeed. In at least one instance, attackers successfully performed a GetSecretValue request against a production secret, and elsewhere used valid AWS identities for S3 discovery and object operations.

AI Tools in Cyber Attacks

The AntiFox disclosure comes as threat actors increasingly weaponize AI-powered penetration testing tools like ARTEX to conduct broad-scale attacks. These tools enable automation of various intrusion stages with minimal human intervention, allowing adversaries to adapt established tradecraft at machine speed.

Recently, VECERT disclosed Operation Ghost-Campus, a campaign by a Chinese threat actor using AI agents to maintain perpetual access to large language models (LLMs) for automated academic fraud and data theft from over 5,000 students. The agents create accounts on search engines, scan for misconfigured servers, extract API keys, and verify their financial balances.

According to Censys, 1,465 hosts are running exposed ARTEX consoles as of November 4, 2026, with most located in the U.S., Hong Kong, China, Japan, Singapore, and South Korea. Check Point Research identified 2,557 systems hosting ARTEX, including 10 misconfigured instances exposing their full databases.

Agentic Frameworks Landscape

Tools like AntiFox and ARTEX are part of a broader set of about 45 open-source agentic attack frameworks engineered to connect to an LLM and act autonomously. These frameworks fall into five categories: network kill chain, web-app and API, C2-integrated, harnesses, and research prototypes.

Each framework has public source code and wires a model into a loop that runs tools and acts on their output. "Agentic AI pentesting tools hand their agent a shell and web access, so the model can assemble a pipeline at runtime," GitGuardian explained. "A GitHub search, a scanner download, and a found key passed to the next call are all one prompt away."

The biggest change brought by agentic hacking is scale and speed, as cybercriminals with limited technical skills can task AI agents with investigating multiple targets in parallel and exploiting them using known and zero-day vulnerabilities with less manual effort. CERT-EU emphasized that these tools can test large numbers of low-complexity misconfigurations that human testers might notice but not have time to check.