Attackers abuse AI pentest agent AntiFox to steal AWS production secrets
Attackers are running self-hosted copies of AntiFox, an open-source Chinese-language AI penetration-testing platform, from Alibaba Cloud servers to break into internet-facing web servers and AWS accounts — and in at least one intrusion they pulled a production secret out of AWS Secrets Manager.
📊 Scorecard: our Bearish call on $AMZN is scored from $266.17, the last close before it ran. Its first result comes after the next close.
The News
Attackers are running self-hosted copies of AntiFox, an open-source, Chinese-language agentic penetration-testing platform, from Alibaba Cloud servers to break into internet-facing web servers and AWS accounts, according to an Arctic Wolf Labs report published on November 10 and reported on November 11. An agentic platform uses an AI agent to carry out multi-step tasks on its own — here, probing systems the way a security tester would, except the testers are attackers. AntiFox is a fork of the ARTEX framework created on GitHub in October, and Censys counted 1,465 exposed ARTEX consoles as of November 4.
In several intrusions, the attackers entered through a compromised internet-facing IIS application — Microsoft's web server software — dropped an ASPX web shell, and read web.config files and database connection strings. A web shell is a hidden back door left on a web server; a connection string is the set of details an application uses to connect to its database, often including a password. From there they used valid IAM identities — in some cases an assumed EC2 role — to enumerate dozens of AWS services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS and Bedrock. Most of their API requests were denied, which means the permissions they held were limited. But in at least one intrusion an attacker made a successful GetSecretValue call against a production secret — the AWS command that retrieves a stored secret such as a password or API key — and in another they performed S3 object operations on files in Amazon's S3 storage service.
Two things about this campaign are unknown. The initial IIS vulnerability — the flaw that let the attackers into the web application — is unknown, and how the first AWS credentials were obtained is also unknown. Amazon told BleepingComputer that AWS services were not compromised and operated as designed, and that the attackers used credentials taken from customers' compromised applications. The cloud itself was not broken into, but once the attackers held valid credentials, AWS treated their requests as legitimate, because that is what the system is designed to do.
An AI built to find weaknesses is now finding them for the attackers — and it only needed stolen keys to walk into AWS.
Why It Matters
This matters because it is a new shape of attack: an AI agent doing the attacker's work. AntiFox is built to probe systems for weaknesses autonomously, step by step, the way a penetration tester would. Put in attacker hands, that same autonomy means the break-in, the search for credentials and the sweep through AWS services can run with far less human effort. The tool is open source, and Censys counted 1,465 exposed ARTEX consoles as of November 4.
It also matters because of where the attack succeeded. Most of the attackers' API requests were denied — the permissions they held were limited, and AWS's controls did what they were supposed to do. But one GetSecretValue call against a production secret succeeded, and in another intrusion they performed S3 object operations. A production secret is a live credential: a password, a key, something a real system uses every day. Once an attacker holds it, they can come back as a legitimate user, and the cloud has no way to tell the difference. That is why Amazon's statement — AWS was not compromised, it operated as designed — is both true and beside the point. The design assumes credentials are held by their rightful owners.
For Amazon and Alibaba, the read is negative because the story lands on both of them: AWS accounts were the target, and Alibaba Cloud servers hosted the attackers' AntiFox consoles. Neither company is accused of a flaw — Amazon says its services were not compromised, and the Alibaba link is about where the tooling ran, not a breach of Alibaba's cloud. But the campaign shows that AI agent tooling has crossed from a security-testing curiosity into a live attack method, and the 1,465 exposed consoles suggest the supply of that tooling is not going away. The verdict is Bearish because a production secret was actually taken, and because the two unknowns — the entry flaw and the first credential theft — mean defenders do not yet know how to stop the next one.
Analyst's Take
Our call is Bearish. A security-testing AI turned against live systems is a bad sign on its own, but the detail that makes this Bearish is the production secret: in at least one intrusion, the attackers got past the denied requests and pulled a real secret out of AWS Secrets Manager. That is not a theoretical risk — it is a credential in attacker hands, and credentials are what turn a web-server break-in into a cloud-account compromise. The unknowns compound it: nobody yet knows which IIS flaw opened the door, or how the first AWS credentials were obtained.
What to watch: whether more intrusions surface as defenders search for the AntiFox pattern, whether Amazon or Arctic Wolf names the IIS flaw, and whether the exposed ARTEX consoles — 1,465 of them as of November 4 — get taken down or secured. For AWS customers, the immediate lesson is practical: rotate secrets, audit IAM roles, and check whether any web application is holding credentials an attacker could read from a config file. The cloud worked as designed. That is precisely the problem — it cannot tell a stolen key from a legitimate one.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is AntiFox?
AntiFox is an open-source, Chinese-language agentic penetration-testing platform — software that uses an AI agent to probe systems for weaknesses, the way a security tester would. It is a fork of the ARTEX framework, created on GitHub in October. It is a legitimate testing tool in principle, but attackers are running their own copies of it to break into real systems.
How did the attackers get in?
In several intrusions they entered through a compromised internet-facing IIS application — Microsoft's web server software — dropped an ASPX web shell, read web.config files and database connection strings, then used valid IAM identities to enumerate dozens of AWS services. A web shell is a hidden back door left on a web server. How the first AWS credentials were obtained is unknown, and the initial IIS vulnerability is also unknown.
What is an IAM identity?
IAM, or Identity and Access Management, is Amazon's system for deciding who and what can do things inside an AWS account. An IAM identity is a set of credentials — a user, a role or a key — that carries permissions. In some cases the attackers assumed an EC2 role, meaning they took on the permissions of a cloud server to act inside the account.
Did Amazon's cloud get hacked?
Amazon told BleepingComputer that AWS services were not compromised and operated as designed, and that the attackers used credentials taken from customers' compromised applications. In other words, the break-in was through the customers' own web applications, not through a flaw in AWS itself — but once the attackers held valid credentials, AWS treated their requests as legitimate.
What did the attackers actually steal?
Most of their API requests were denied, but in at least one intrusion an attacker made a successful GetSecretValue call against a production secret — the AWS command that retrieves a stored secret, such as a password or API key — and in another intrusion they performed S3 object operations, meaning they acted on files stored in Amazon's S3 storage service.
👁
Source: The Hacker News; BleepingComputer (for Amazon's statement)