AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets Ravie LakshmananNov 11, 2026Artificial Intelligence / Web Security Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said in a report shared with The Hacker News. The activity has been observed chaining together web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations. AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform. As of writing, the project has been forked 251 times and starred 474 times. On its README page, the project maintainer states - Given an authorized target, a planner / worker / main-agent multi-agent system runs the full engagement over a dual-graph core (a global asset graph + a per-task exploration graph) — recon → attack-surface discovery → exploitation → finding capture → report delivery — fully observable, interactive, and deliverable Unlike most automated pentest tools that are "great at discovery, but stop at discovery," AntiFox puts its weight on delivery — turning what the AI finds into a report that an engineer can understand, reproduce, back with evidence, and hand straight to the client. According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application. The access is then leveraged to create an ASPX web shell using "w3wp.exe," the IIS worker process, and run operating system commands to perform the following actions - Run PowerShell commands to locate web.config files and configuration backups Read application settings and database connection strings Enumerate debug and error-log directories Attempts to connect to an internal production database using a credential extracted from the application configuration Copy configuration and log files into a web-accessible upload directory "On a compromised IIS server, commands run through w3wp.exe identified the execution context with whoami, enumerated the application directory, checked permissions with icacls, and tested the ability to write files into the web root," Arctic Wolf said. "The creation of an ASPX web shell by w3wp.exe, followed by command execution through the same IIS worker process, suggests compromise through the affected web application." The precise vulnerability used to achieve code execution on the IIS server is not known. In other attacks, the threat actor is said to have started with a valid AWS credential obtained through as-yet-undetermined means. Specifically, this involved abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock. While a majority of these authenticated cross-service API requests ended up with an "AccessDenied" error, some of the discovery and secret-access operations were successful, according to the cybersecurity company. In at least some instances, the activity has been observed progressing beyond Secrets Manager enumeration to a successful GetSecretValue request against a production secret. Elsewhere, a valid AWS identity was used for S3 discovery and object operations via API calls. "Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks," Arctic Wolf said. The disclosure comes as threat actors are increasingly weaponizing AI-powered penetration testing tools like ARTEX to conduct broad-scale attacks across the world, enabling them to automate various stages of an intrusion with minimal human intervention. The integration of AI has allowed adversaries, both large and small, to adapt established tradecraft and deploy them at machine speed, making it possible to progress from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes. Earlier this week, VECERT disclosed details of a campaign dubbed Operation Ghost-Campus orchestrated by a Chinese threat actor that uses AI agents to maintain perpetual, cost-free access to large language models (LLMs) and eventually perform automated academic fraud and steal data belonging to over 5,000 students enrolled at the Fengxian Campus. "The agent industrializes the creation of accounts on the search engine fofa.info, scans the global cyberspace for misconfigured servers, extracts API keys for OpenAI and DeepSeek, automatically verifies their financial balances, and injects them into the attacker's development environment," VECERT said. "This stolen computing power fuels an interactive GoTTY terminal ('Pi — AI Coding Assistant') and, by extension, provides intelligence to the scripts that sustain academic fraud bots ('heartbeat' bots) and extractors of financial data and personally identifiable information (PII) belonging to thousands of students at the Fengxian Campus." According to data from Censys, there are 1,465 hosts running an exposed ARTEX console as of November 4, 2026, with most of them located in the U.S., Hong Kong, China, Japan, Singapore, and South Korea. However, it's worth noting that not every instance is necessarily malicious in nature. In a separate report, Check Point Research said it identified 2,557 systems that hosted ARTEX, including 10 misconfigured instances exposing their full databases. "In many observed cases, ARTEX required remarkably little interaction from its operators once an objective had been established," Check Point said. "Rather than continuously directing attacks step by step, operators frequently issued a goal and left the agent fleet to work toward it. Human interactions were largely limited to checking progress, asking whether a target had been compromised or occasionally adjusting priorities." The vast majority of the attacks are designed to siphon cryptocurrency, steal Apple code-signing certificates, compromise gaming accounts, and conduct denial-of-service (DoS) attacks against gambling websites. The activity has been found to exploit vulnerabilities related to weak or hard-coded passwords, missing authentication, insecure direct object references, and remote code execution. In the campaign targeting Apple code-signing certificates, ARTEX agents searched compromised systems for certificate databases, followed by validating the stolen certificates by checking passwords, private keys, Apple revocation status, expiration dates, and associated provisioning profiles. Ultimately, the activity is estimated to have harvested more than 300 certificates and their passwords, out of which three certificates passed the full validation process and could be used to sign arbitrary iOS applications. The biggest change brought by agentic hacking to the cyber threat landscape is scale and speed, Check Point cautioned, as a cybercriminal with limited technical skills can task AI agents with investigating a number of targets in parallel and exploiting them using known and zero-day vulnerabilities with less manual effort. "Its relevance to us lies in its scale, speed and persistence," CERT-EU said in an alert. "ARTEX can test large numbers of low-complexity misconfigurations, including those a human tester would notice but not have time to check, and it can work through long attack chains without the fatigue that limits manual testing." "The same is true of complex payload crafting. Exploitation paths that need carefully tailored payloads often take more effort than the severity of the finding justifies, so a manual assessment may leave them untested." Tools like AntiFox and ARTEX are part of a broader set of about 45 open-source agentic attack frameworks that are engineered to connect to an LLM and can act on outputs autonomously. They fall under five broad categories - Network kill chain capable of end-to-end reconnaissance, exploitation, and post-exploitation: PentAGI, RedAmon, and DarkMoon Web-app and API: Strix, Shannon, and PentestGPT C2-integrated: Sage, echidna, Pojun, and FORANG Harnesses: RAPTOR, CyberStrike, cyber-harness, Nebula and Cybermes Research prototypes: Incalmo, hackingBuddyGPT, VulnBot, HackSynth, AutoPT, and Ares "Each framework has public source code and wires a model into a loop that runs tools and acts on their output," GitGuardian said. "Agentic AI pentesting tools hand their agent a shell and web access, so the model can assemble a pipeline at runtime. A GitHub search, a scanner download, and a found key passed to the next call are all one prompt away, even though none of it ships in the repository." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cloud security, Credential Theft, Cyber Attack, Web Security Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 The Flood is Coming And The Pipes Were Already Full See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk