Follow us on Google News
New Delhi: Cybercriminals have begun using an artificial intelligence-based agentic penetration testing platform called AntiFox to target Amazon Web Services cloud environments. Attackers are deploying their own AntiFox servers on Alibaba Cloud to scan internet-facing web servers for vulnerabilities. Once inside, they deploy webshells, collect system settings and configuration details, and attempt to steal sensitive AWS credentials and secrets. Security researchers have identified multiple incidents in which infrastructure linked to AntiFox was used in active cyberattacks.
Researchers at cybersecurity firm Arctic Wolf found that systems connected to an AntiFox interface hosted on Alibaba Cloud carried out suspicious operations against AWS. These activities involved the use of valid AWS identities. The attackers sent authenticated requests to various AWS service endpoints using IAM users and, in some cases, EC2 roles. This indicates that the intruders were not merely probing from outside networks, but already possessed legitimate access credentials to move deeper inside cloud environments.
Webshells Used to Gain Server Control
In one documented case, the attackers deployed an ASPX webshell on an internet-facing Microsoft IIS server. A webshell is a malicious script placed on a website or server that enables remote command execution. Using this access, the intruders ran operating system commands and inspected application settings.
The investigation revealed that the attackers also extracted database connection strings containing sensitive authentication details. Furthermore, they copied server configuration files and logs into a directory accessible over the web, creating a direct path to exfiltrate critical system data.
Hundreds of AWS API Requests in 30 Minutes
In another operation, the attackers used valid IAM credentials and EC2 roles to probe different AWS endpoints. According to researchers, a single intrusion saw hundreds of API requests sent across multiple identities within roughly 30 minutes. While security controls blocked most of these attempts, several requests succeeded, allowing the attackers to retrieve sensitive secrets used in production environments.
Production secrets typically include API keys, access tokens, and database passwords that grant access to core digital infrastructure. Compromising these credentials puts not only a single server at risk, but also connected cloud resources and applications. In a separate incident, attackers used valid AWS identities to read, copy, and delete files and objects stored in S3 buckets, demonstrating that the stolen credentials were used for active data manipulation rather than reconnaissance alone.
Concerns Grow Over Agentic AI Tools
AntiFox is an open-source agentic penetration testing platform originally developed as a fork of ARTEX 0.1.1, featuring a Chinese-language interface. It allows users to deploy AI agents that automate standard security testing tasks, including discovering exposed servers, mapping networks, and scanning target endpoints for flaws. While agentic AI can execute multi-step workflows toward a defined goal, its automation capabilities can make cyberattacks faster and more systematic when misused.
The emergence of AntiFox follows reported abuses of ARTEX AI, another Chinese-developed agentic testing framework linked to cyberattacks against South Korean banks before transitioning from open-source to closed-source. Cybersecurity firm CrowdStrike previously connected ARTEX to espionage campaigns by the Chinese hacking group Vapor Panda, which targeted over 200 organizations across 14 countries.
AntiFox remains available on GitHub in version 2.0, which improves finding logs and report generation. Although its publishers state that the tool must not be used against live systems or for unauthorized activities, no technical safeguards appear to enforce these restrictions. Researchers advise organizations to correlate IIS webshell activity with unusual AWS access patterns, revoke compromised sessions and keys immediately, and rotate exposed credentials.
