AntiFox AI agents used in attacks targeting AWS credentials

Security researchers say attackers are using self-managed AntiFox instances hosted on Alibaba Cloud to target web services and Amazon Web Services (AWS) environments.

Arctic Wolf observed AntiFox-linked infrastructure making authenticated AWS API requests with valid identities, including IAM users and, in some cases, assumed EC2 roles. The researchers say the infrastructure was also used for vulnerability exploitation, webshell deployment, credential validation, configuration discovery and AWS secret harvesting.

In one case, an attacker installed an ASPX webshell on an internet-exposed IIS server, ran operating-system commands, accessed application settings and database connection strings, and copied configuration and log files to a web-accessible directory. The attacker then used valid IAM credentials and EC2 roles to probe AWS endpoints. In one intrusion, the attacker cycled through multiple identities and made hundreds of API requests in about 30 minutes. Most attempts were blocked, but some succeeded and exposed production secrets, the researchers say. In a separate incident, attackers used a valid AWS identity to read, copy and delete S3 objects.

AntiFox began as a fork of ARTEX 0.1.1 and provides a Chinese-language interface for deploying AI agents to automate penetration-testing tasks. It remains available on GitHub and has been updated to version 2.0, which improves documentation and reporting of findings. Its publishers prohibit use against live systems and for illegal or destructive activity, but the source says they describe no technical controls enforcing those restrictions.