Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said in a report shared with The Hacker News.
The activity has been observed chaining together web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations.
AntiFox Capabilities and GitHub Presence
AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform. As of writing, the project has been forked 251 times and starred 474 times. On its README page, the project maintainer states that given an authorized target, a planner/worker/main-agent multi-agent system runs the full engagement over a dual-graph core — recon, attack-surface discovery, exploitation, finding capture, and report delivery — fully observable and interactive.
According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application. The access is then leveraged to create an ASPX web shell using "w3wp.exe," the IIS worker process, and run operating system commands to locate web.config files, read application settings and database connection strings, enumerate debug directories, and attempt connections to internal production databases.
AWS Credential Abuse and Service Enumeration
In other attacks, the threat actor started with a valid AWS credential obtained through undetermined means. This involved abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, and Amazon Bedrock. In at least some instances, the activity progressed to a successful GetSecretValue request against a production secret.
"Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks," Arctic Wolf said.
Broader Trend of AI-Powered Attack Tools
The disclosure comes as threat actors increasingly weaponize AI-powered penetration testing tools like ARTEX to conduct broad-scale attacks. Earlier this week, VECERT disclosed details of a campaign dubbed Operation Ghost-Campus orchestrated by a Chinese threat actor that uses AI agents to maintain perpetual access to large language models and perform automated academic fraud.
According to data from Censys, there are 1,465 hosts running an exposed ARTEX console as of November 4, 2026. In a separate report, Check Point Research said it identified 2,557 systems that hosted ARTEX, including 10 misconfigured instances exposing their full databases. The vast majority of the attacks are designed to siphon cryptocurrency, steal Apple code-signing certificates, and compromise gaming accounts.
Tools like AntiFox and ARTEX are part of a broader set of about 45 open-source agentic attack frameworks that fall under categories such as network kill chain, web-app and API, C2-integrated, harnesses, and research prototypes.
