Attackers use AntiFox AI tool to automate AWS credential theft

The rise of agentic testing

Arctic Wolf Labs recently identified a trend where attackers are using AntiFox to conduct automated intrusions. AntiFox is an open-source, Chinese-language agentic penetration testing platform designed to chain together various attack steps. This automation allows malicious actors to execute complex sequences with very little human effort required during the process.

The research highlights that these frameworks are becoming increasingly accessible to hackers. By using agentic technology, the tool can navigate through different stages of a breach autonomously. This shift moves away from manual, one-off exploits toward persistent, automated workflows that can operate continuously.

Security researchers are specifically tracking the use of these self-hosted frameworks from public cloud infrastructure. In several observed cases, Alibaba Cloud systems were found hosting the AntiFox interfaces. These systems were then linked to confirmed attacks on internet-facing web services and the underlying AWS environments.

Breaching web applications

One method of entry identified by researchers involved targeting public IIS applications. While the specific vulnerability used to gain entry was not identified, the behavior following the breach followed a consistent pattern. Once inside, the IIS worker process, known as w3wp.exe, was used to create an ASPX web shell.

The attackers then ran a series of commands to gather information about the compromised system. They checked user accounts, listed files in application folders, and reviewed file permissions using the icacls tool. They also tested whether they had the ability to write new files to the website's main folder.

To find deeper secrets, the attackers used PowerShell to read the web.config file for database connection details and application settings. They also searched for debug and error logs. After finding credentials in these configuration files, they attempted to connect to internal production databases and copied logs into accessible upload folders.

Rapid AWS enumeration

The attacks moved with significant speed once the hackers reached the AWS environments. AntiFox utilized valid IAM accounts and, in some instances, assumed EC2 roles to begin its work. The tool first checked the identity and permissions of the current session to understand what it could access.

The framework then began a rapid discovery phase using commands like GetCallerIdentity and ListRoles. In one specific intrusion, the tool cycled through several AWS identities and sent hundreds of requests in about half an hour. It targeted a wide range of services, including S3, Lambda, Secrets Manager, and Amazon Bedrock.

The attackers focused on resources that remained accessible after receiving authorization failures. While many requests resulted in AccessDenied errors, the tool continued to probe until it found open doors. Some sequences ended successfully with a GetSecretValue request against a production secret, while others involved listing and deleting objects in S3 buckets.

Detecting automated threats

Security experts warn that a series of mostly denied requests does not mean an attack was unsuccessful. Because the tool is automated, it can persist through failures to find the few permissions that are actually open. Organizations need to look for specific patterns of behavior that suggest an agentic framework is at work.

On the AWS side, defenders should watch for activity coming from hosting providers that an identity has never used before. They should flag instances where a single IP address uses many different access keys or roles in a short timeframe. Rapid runs of List, Get, and Describe calls across unrelated services are also key indicators of automated discovery.

For Windows environments, administrators should monitor for the IIS process launching command shells like cmd.exe or powershell.exe. They should also look for new .aspx files in temporary folders or configuration files saved with image extensions. Monitoring for PowerShell commands that read connection strings or app settings is a critical step for identifying these early-stage intrusions.

Hardening your infrastructure

To defend against these automated tools, organizations should prioritize patching internet-facing applications. Specifically, services that handle file uploads, document processing, or image conversion should be closely monitored. If an IIS process starts an unexpected command shell, administrators should immediately isolate the server and preserve logs for forensic evidence.

Cloud environments should be secured by enforcing IMDSv2 and applying least-privilege permissions to all applications. Enabling AWS CloudTrail logging and monitoring access to sensitive S3 storage is also recommended. Using S3 versioning and Object Lock can provide an extra layer of protection against the deletion of important data.

Finally, companies should set up alerts for suspicious access to stored secrets, especially when it follows unusual account activity. Revoking compromised AWS sessions and access keys is essential once a breach is detected. By limiting the scope of what any single application can access, organizations can reduce the damage an automated tool can do.