Attackers are using AntiFox AI agents in AWS credential theft, researchers say

In one intrusion, infrastructure linked to a tool called AntiFox cycled through several Amazon Web Services identities and made hundreds of API requests in about half an hour. Most of those calls were denied. Some were not. Arctic Wolf Labs, whose research is reported by BleepingComputer and SecurityBrief, says that burst of AWS credential theft at times ended with a successful read of a production secret.

AntiFox is an open-source, Chinese-language penetration-testing platform. BleepingComputer reports that it began as a fork of ARTEX 0.1.1 and lets users deploy AI agents to automate common testing tasks, such as mapping exposed services and probing endpoints. Arctic Wolf linked the malicious activity it observed to self-managed AntiFox instances hosted on Alibaba Cloud. Those systems were used to exploit web services, deploy web shells, validate credentials, read configuration files, and harvest AWS secrets.

How the AWS credential theft worked

On compromised Microsoft IIS servers, Arctic Wolf’s telemetry showed the IIS worker process creating an ASPX web shell and then launching operating-system commands. Those commands checked where they were running, inspected application folders, tested write permissions, and looked for web.config files and configuration backups. PowerShell then parsed connection strings and application settings. In one case, the activity tried to connect to an internal production database with a credential taken from the application configuration.

The researchers did not identify the exact vulnerability used to get code execution on the exposed web server. In some incidents the starting point appeared to be the IIS application. In others, the actor began with a valid AWS credential obtained through unknown means.

Once valid cloud identities were available, AntiFox-linked infrastructure used authenticated requests with IAM users — the named accounts in an AWS environment — and, in some cases, an assumed EC2 role, to test what each identity was allowed to do. The pattern, Arctic Wolf said, looks like automated testing of collected credentials, continuing across services even after repeated “access denied” responses. That sweep covered a long list of AWS services, including IAM, EC2, S3, Lambda, Secrets Manager and Amazon Bedrock.

In one intrusion, the activity progressed from listing Secrets Manager entries to a successful read of a production secret. In a separate incident, BleepingComputer and SecurityBrief report, a valid AWS identity was used to read, copy and delete S3 objects. Arctic Wolf’s advice is pointed: do not assume an attack has failed simply because many API calls were denied. Successful discovery and secret-access operations can appear in the same burst of automated requests.

What’s confirmed versus unknown

Confirmed, as reported from Arctic Wolf Labs’ research: AntiFox-linked infrastructure on Alibaba Cloud was used against IIS servers and AWS environments; web shells and configuration discovery were observed; valid IAM users and, in some cases, assumed EC2 roles were used to probe AWS APIs at high speed; at least one intrusion reached a production secret; and a separate incident included reading, copying and deleting S3 objects.

Unknown or not yet stated in the sources: the exact vulnerability used against the IIS servers; how some valid AWS credentials were first obtained; the number of victims; and the names of the affected organisations. The reports do not name a threat group.

Three things to do today

1. Search application configuration files, deployment artefacts, logs and environment variables for AWS access keys or Secrets Manager references, and rotate anything you find with the provider that issued it.
2. In the AWS billing and CloudTrail views you already have, look for API activity from unfamiliar hosting providers, or a single source address using several access keys or roles in a short period, and revoke sessions or keys you do not recognise.
3. On any internet-facing IIS server, look for newly created ASPX files in writable web folders and for the web-server process launching tools such as Command Prompt or PowerShell. If you see that, isolate the server and rotate the credentials it could have read.

A next step

If your team is trying to get ahead of AI-enabled attacks without a large security staff, use our free AI-safety checklist. It is a practical list you can work through today, and you can download a PDF to keep beside the team.