AntiFox, an AI-agent pentest platform, is repurposed to steal AWS secrets

November 11, 2026. Arctic Wolf publishes its analysis of AntiFox, an AI-agent-driven pentest platform, used offensively against web services and AWS environments. 2.0. That is the project version, now able to document and report its own findings. About thirty minutes. That is how long one attacker took to chain hundreds of API calls with stolen identities. Why it matters: autonomous AI agents are no longer a lab demonstration — they exploit flaws, deploy webshells, and harvest production secrets.

AntiFox, the direct heir of ARTEX

AntiFox began as a fork of ARTEX 0.1.1, the other agentic pentesting framework developed in China, whose story has been documented here before — the Vapor Panda espionage campaign pushed it closed-source after attacks on South Korean banks. AntiFox picks up the principle, with a Chinese-language interface and a simple promise: let the user deploy AI agents that automate pentest tasks — mapping exposed services, probing entry points, hunting for vulnerabilities. CrowdStrike has also linked ARTEX to an espionage campaign in which the Chinese group Vapor Panda targeted more than 200 organizations across 14 countries — which pushed the project closed-source.

What changes with version 2.0, still available on GitHub, is the feedback loop: the tool documents and reports its own findings, making it an end-to-end assistant rather than a mere scanner. The tool is not the problem — a legitimate pentester uses it like a colleague. The problem is what happens when the same autonomy lands in other hands.

What the agents do once released

Arctic Wolf’s report describes self-hosted instances of AntiFox on Alibaba Cloud, tied to confirmed malicious activity against internet-facing web services and the AWS environments linked to them. The catalogue of observed activity reads like a real pentest’s work plan, except it is executed without a mandate:

• exploiting vulnerabilities on internet-reachable web services;
• deploying webshells — including an ASPX webshell dropped on an exposed IIS server;
• credential validation and configuration discovery;
• harvesting AWS secrets.

The case study the researchers detail shows the depth of a successful intrusion. After dropping an ASPX webshell on an IIS server, the attacker ran OS commands, read application settings and database connection strings, then copied configuration and log files to a web-accessible directory. From there it held whatever those files contained — which, often, includes credentials.

The choice of Alibaba Cloud for hosting is not incidental. Instances there are rented on demand, paid anonymously, and takedown requests cross legal borders that Western incident-response teams do not cross quickly. It is the same logic already seen with ARTEX, whose infrastructure operated from hosts that were hard to reach — the attacker picks the place where it will be pursued the least.

The AWS angle: valid identities, not a cloud flaw

The most instructive part of the report concerns AWS. The attackers did not exploit a cloud vulnerability. They used valid AWS identities — IAM users and, in some cases, assumed EC2 roles — to make authenticated calls to Amazon Web Services APIs. In other words, they did exactly what a compromised application is authorized to do.

One case illustrates the method: the attacker cycled through several identities and fired hundreds of API calls in about thirty minutes, obtaining production secrets despite occasional denials. In another incident, a valid identity was used to read, copy, and delete S3 objects. Arctic Wolf’s guidance is unambiguous: revoke affected AWS sessions and keys, rotate credentials exposed through application files, and correlate webshell activity with unusual AWS access — particularly successful calls inside bursts of denials.

Amazon responded on November 12 through a spokesperson: “AWS services were not compromised and operated as designed,” clarifying that the researchers describe actors using credentials taken from customers’ compromised applications. The cloud giant points back to its standing recommendations — least privilege, IMDSv2 on EC2 instances, no long-term keys in application configuration, and GuardDuty turned on.

Arctic Wolf’s most actionable detection hint sits in that list: watch for successful API calls inside bursts of denials. A human attacker pauses after each rejection; an agent does not. A handful of successes wrapped in hundreds of denials over a few minutes is the fingerprint of an autonomous tool working through a stolen credential list — and it is visible in CloudTrail, if you know to query for it.

The real lesson: agents lower the barrier

The heart of the matter is neither AntiFox nor ARTEX in particular. It is that agentic AI has crossed a threshold: an operator no longer has to chain reconnaissance, exploitation, and exfiltration by hand — the agent orchestrates the sequence. AntiFox’s publishers explicitly forbid use against live systems, in real-world tests, or for illegal activity, but they describe no technical control that enforces those restrictions. The line between the legitimate tool and the offensive weapon holds only on the user’s good faith.

It is the same trajectory already seen with autonomous llmjacking agents: the marginal cost of an automated attack collapses, and with it the barrier to entry. For defenders the consequence is concrete — the signals of an agentic attack are abnormally fast and noisy: bursts of API calls, identities that alternate, webshells that write into public directories.

AntiFox itself is a symptom of a broader dilemma: the same open-source agentic tooling that lets a legitimate red team automate an engagement lets an attacker automate an intrusion, at near-zero marginal cost. The authors’ usage prohibitions are unenforceable, so the burden shifts entirely to the defender — which is why the detection playbook (telemetry on call bursts, least privilege, IMDSv2) matters more than any takedown request.

The contrast with manual pentesting is sharp. A human chains reconnaissance, exploitation, and exfiltration over hours or days, with pauses and mistakes; the agent chains them in minutes, without fatigue and without fear of being spotted. That is what explains the hundreds of API calls in thirty minutes described by Arctic Wolf — a pace a human operator could not sustain. For the defender it is, paradoxically, an opportunity: that abnormal pace is itself a detectable signal, provided the telemetry that sees it is switched on — and switched on before the agent shows up, not after.

Verdict

If you expose web services and AWS identities can be read from your application files, the risk described here concerns you directly, even without a flaw in your code — because the work is no longer carried by a human, but by an agent that automates the entire chain. The countermeasures to apply now are the ones Amazon recommends: least privilege on roles, mandatory IMDSv2, no long-term keys in configuration, and GuardDuty active to catch call bursts and rotating identities. If you sit on the research side, this report is a milestone: agentic AI is no longer a forecasting topic, it is a tool already present in real incidents — and it runs on stolen legitimate credentials, not on zero-day exploits.

References

• BleepingComputer — “Hackers use AntiFox AI agents in AWS credential-theft attacks” (Bill Toulas, November 11, 2026)
• The Hacker News — “AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets” (November 11, 2026)
• ETTAYEB — ARTEX and the Vapor Panda campaign
• ETTAYEB — llmjacking and autonomous agents