“In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments,” Arctic Wolf says.
Arctic Wolf’s findings: AntiFox hosted on Alibaba Cloud with valid AWS identities
Security researchers at Arctic Wolf traced infrastructure used to host self-managed instances of AntiFox — an open-source, agentic penetration-testing platform — on Alibaba Cloud. Those hosting systems were observed making authenticated requests to Amazon Web Services APIs using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles. Arctic Wolf reports that the same infrastructure supported a range of malicious activities, from web vulnerability exploitation to harvesting AWS secrets.
Attack techniques observed: webshells, configuration theft, and API bursts
The report documents multiple intrusion patterns. In one case attackers deployed an ASPX webshell to an internet-exposed IIS server, executed operating-system commands, read application settings and database connection strings, and copied configuration and log files into a web-accessible directory. In parallel, the threat actors used valid IAM credentials and EC2 roles to probe AWS endpoints; in one intrusion they cycled through multiple identities and made hundreds of API requests over roughly 30 minutes. Although Arctic Wolf says most of these API attempts were blocked, some succeeded and the attackers obtained production secrets. In a separate incident, the attackers used a valid AWS identity to read, copy, and delete S3 objects.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageAntiFox’s lineage and availability: a fork, a Chinese interface, and a v2.0 update
AntiFox was initially created as a fork of ARTEX 0.1.1. The tool presents a Chinese-language interface and enables users to deploy AI agents that automate common penetration‑testing tasks such as mapping exposed services and probing endpoints for vulnerabilities. AntiFox remains available on GitHub and has been updated to version 2.0, which Arctic Wolf says improves how the tool documents and reports findings. The tool’s publishers state that AntiFox must not be used against live systems, in real-world penetration tests or security exercises, or for destructive or illegal activity; Arctic Wolf notes the publishers do not describe any technical controls that enforce those restrictions.
Connections to ARTEX and prior campaigns
The AntiFox findings follow recent incidents involving ARTEX AI, another agentic penetration‑testing framework developed in China that went closed-source after it was used in attacks on South Korean banks. CrowdStrike also linked ARTEX to a cyberespionage campaign in which the Chinese hacking group Vapor Panda targeted more than 200 organizations across 14 countries. Arctic Wolf frames AntiFox activity as part of the same wider phenomenon in which agentic frameworks are adopted and adapted into malicious operations.
Defender guidance from Arctic Wolf
Arctic Wolf’s report includes specific hunting guidance and response actions for defenders. They recommend correlating IIS webshell activity with unusual AWS access patterns, and reviewing successful API calls that occur within bursts of denials. When intrusions are confirmed, Arctic Wolf advises revoking affected AWS sessions and keys and rotating credentials that have been exposed through application files. Those steps are presented as immediate remediation to contain access abuses and limit further secret harvesting.
What this means for AWS customers, Alibaba Cloud tenants, and open-source maintainers
- AWS customers should watch for combined indicators: signs of webserver compromise (for example, ASPX webshells on IIS) alongside authenticated AWS API activity tied to IAM users or assumed EC2 roles. Arctic Wolf’s guidance to correlate those signals and to review API calls within bursts of denials is a practical detection priority.
- Alibaba Cloud tenants and administrators should be aware that self‑managed compute hosting tooling like AntiFox can be repurposed to reach outside environments; Arctic Wolf’s observations show Alibaba Cloud hosts were used to make authenticated AWS requests and stage additional actions against internet-facing web services.
- Open-source maintainers of agentic penetration frameworks face a governance question: AntiFox’s publishers explicitly prohibit misuse but have not described technical controls to prevent it. The AntiFox v2.0 update improves documentation and reporting, but the absence of enforcement mechanisms is a factor Arctic Wolf highlights.
Arctic Wolf’s report ties together a short chain of facts: agentic tools are available and being self‑hosted, hosting infrastructure on one cloud can be used to attack services and cloud accounts elsewhere, and credential misuse can enable data exfiltration and object deletion. The concrete, immediate steps Arctic Wolf offers — correlate webshells with AWS access, hunt for API-burst anomalies, revoke sessions and rotate exposed keys — close the loop from detection to response. A remaining question implicit in the report is whether publishers of agentic tooling will add technical safeguards beyond use policies to reduce the ease with which those tools are repurposed in live attacks.
Read Arctic Wolf’s reporting at the original story: https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
