Attackers use open-source AI pentest agent AntiFox to steal AWS secrets

The rise of AntiFox

Security researchers have identified a new campaign where attackers use a tool called AntiFox to conduct automated cyberattacks. AntiFox is an open-source AI agent specifically built for penetration testing, which is the practice of simulating cyberattacks to find vulnerabilities. It is described as a multi-agent platform that can handle everything from initial reconnaissance to final report writing.

The tool is an AGPL-licensed fork of a framework called ARTEX, which was first created on GitHub in October. While the publishers of AntiFox state that the tool should not be used against live systems or for illegal activities, they do not include any technical controls to enforce these rules. This lack of restriction allows malicious actors to deploy the software for harmful purposes.

The tool gained some traction quickly, garnering 482 stars and 252 forks on GitHub. Because it is free and designed to be autonomous, it provides a ready-made toolkit for hackers who want to automate the tedious parts of breaking into a network. By using AI to navigate these steps, attackers can move through a system with much higher speed and consistency than manual methods.

How the attacks are unfolding

According to a report by Arctic Wolf, attackers are hosting AntiFox web consoles on Alibaba Cloud to target internet-facing web services. In some instances, the entry point was a compromised IIS application. Once inside, the attackers created a web shell, which is a script that allows them to execute commands remotely on a target server.

The attackers used these web shells to read configuration files, such as web.config files, to find database connection strings and other secrets. They then copied these configuration and log files into folders that were accessible over the internet. This allowed them to gather the necessary information to move deeper into the victim's cloud infrastructure.

In other cases, the attackers started with valid AWS credentials obtained through unknown means. From that starting point, the AntiFox-linked infrastructure began probing various services. They used IAM users and assumed EC2 roles to query services like S3, Lambda, Secrets Manager, and Amazon Bedrock using List, Get, and Describe calls.

Automated reconnaissance at scale

One of the most notable aspects of this campaign is the sheer speed at which the AI agent can operate. In one specific case, the attackers cycled through several AWS identities and made hundreds of API requests in about 30 minutes. While the majority of these requests were denied by the system, the high volume allowed them to eventually find successful paths to their goals.

Arctic Wolf warns that security teams should not assume a sequence of requests was unsuccessful just because most were denied. The AI agent is designed to move on whenever it hits a wall, constantly trying different permissions and services until it finds a way in. This persistence makes it difficult for traditional security monitoring to keep up with the rapid pace of the automated probing.

The ultimate goal of these automated actions was the theft of production secrets. The report confirmed that the intrusions ended with successful GetSecretValue calls on production secrets. Additionally, the attackers were observed performing S3 copy and delete operations, indicating they were actively moving and potentially destroying data within the cloud environment.

Indicators and defense steps

To help organizations defend against these attacks, Arctic Wolf identified several indicators of compromise. These include two specific Alibaba-hosted source IP addresses and the default port for AntiFox, which is TCP/8787. They also noted the use of the Boto3 1.43.125 user agent and the specific title of the AntiFox console in web traffic.

Security experts recommend that companies take immediate action if they suspect a breach. This includes rotating any credentials that might have been exposed in logs or configuration files. They also suggest revoking affected AWS sessions and keys to prevent the attackers from maintaining their foothold in the cloud environment.

For long-term protection, the report suggests enforcing IMDSv2, which is a more secure way for instances to access metadata. Organizations should also enable S3 versioning or Object Lock to protect against the deletion of data. Finally, they should set up alerts for any GetSecretValue calls originating from new or unrecognized infrastructure to catch the AI agent in action.

The broader context of ARTEX

The use of AntiFox is part of a larger trend involving the ARTEX framework. Interestingly, the original ARTEX project went closed-source after it was linked to attacks on South Korean banks. This move to close the source code was likely a reaction to the tool being used in high-profile criminal activities.

CrowdStrike has previously linked ARTEX to a campaign known as Vapor Panda. This campaign targeted more than 200 organizations across 14 different countries. The fact that a fork of this framework is now being used as an open-source AI agent shows how easily these capabilities can spread to the public domain.

This situation highlights a growing challenge for the security community: the democratization of powerful hacking tools. When an AI agent can perform reconnaissance, exploitation, and report writing autonomously, the barrier to entry for cybercrime is significantly lowered. Companies must now defend not just against human hackers, but against automated systems that can work at machine speed.