AntiFox: attackers ran an open-source AI pentest platform from Alibaba Cloud to steal AWS secrets, hundreds of API calls in 30 minutes

Arctic Wolf has published a pack alert describing two intrusions in which attackers used AntiFox, an open-source agentic penetration-testing platform, hosted on self-managed Alibaba Cloud instances, to break into web servers and harvest AWS credentials. BleepingComputer reported the research on November 11; Amazon added a statement the following day saying its services "were not compromised and operated as designed" and that the credentials came from customers' compromised applications.

What AntiFox is

AntiFox is a fork of ARTEX 0.1.1, a China-developed framework that went closed-source after it was used against South Korean banks and that CrowdStrike later tied to a Vapor Panda espionage campaign across more than 200 organisations in 14 countries. AntiFox 2.0 is on GitHub with a Chinese-language interface. It lets a user point AI agents at a target to map exposed services, probe endpoints and chain exploits. The project's terms forbid use against live systems, and nothing in the code enforces that.

How the intrusions ran

In the first case the attacker dropped an ASPX webshell on an internet-facing IIS server, ran operating-system commands, read application settings and database connection strings, and copied configuration and log files into a web-accessible directory. With the AWS keys found in those files, the agent cycled through multiple identities, including IAM users and in some cases assumed EC2 roles, and fired hundreds of API requests in roughly 30 minutes. Most were denied. Some succeeded and returned production secrets. In the second case a valid AWS identity was used to read, copy and delete S3 objects.

The thirty-minute burst is the tell. A human attacker enumerating permissions is slow and selective; an agent tries everything its tools expose, accepts the denials, and keeps what works. That is a detection opportunity as much as a threat: the ratio of denied to successful calls from one principal in a short window is a signal most SIEMs can already compute.

Why it matters beyond these two victims

This is the first public, well-documented case of a forkable agentic security tool being operated offensively against cloud estates, and it closes a loop the industry has been watching since the DeepSeek-driven telecom intrusion earlier this week and the SPECTRE implant research in August. Those cases involved jailbroken frontier models. AntiFox needs no jailbreak: it is built to attack, and any model with tool use can drive it. The barrier to running an automated intrusion campaign is now a cloud account and an API key, and the defender's advantage of attacker scarcity is gone.

What to do

Arctic Wolf's recommendations are specific: correlate IIS webshell activity with unusual AWS access, review successful API calls that sit inside bursts of denials, revoke affected sessions and keys, and rotate every credential that lived in an application file. Amazon's add least-privilege policies, IMDSv2 on EC2, GuardDuty, and keeping long-term access keys out of application configuration. Two of those are the same controls Railway's post-mortem landed on this week for a different breach: credentials in files are the common root, and an agent will find them faster than you will.

What to watch

Whether Arctic Wolf or others attribute the operators; whether GitHub acts on the repository, which would mostly move it; and whether cloud providers start flagging agent-shaped API bursts natively, which is the fix that scales.