AntiFox Pentesting Tool Turned Against AWS Credentials

The most useful detail in the AntiFox reports isn't the tool itself. It's how little the attackers needed to do something new. Threat actors ran their own copies of an open source AI penetration testing platform, pointed it at compromised servers, and let its automation hunt for passwords and cloud keys. The tooling was new to the intrusion. The underlying techniques were not.

Security researchers at Arctic Wolf disclosed the activity on GitHub. They observed unnamed threat actors hosting their own AntiFox instances on Alibaba Cloud infrastructure. From there, the agent-style automation analyzed compromised systems, searched for passwords, and worked out how to reach cloud resources. That division of labor is what makes this worth attention. The operator sets the objective, and the tool handles the repetitive reconnaissance that used to take a human hours.

How the intrusions unfolded

In some cases, the entry point was a set of internet-facing Microsoft IIS web servers. Arctic Wolf couldn't determine how the attackers first got in. What they could see was what came next. The intruders installed web shells, which let them run server commands remotely, and then combed through application files and configuration settings. They were looking for database login credentials and other secrets that developers tend to leave lying around in config files.

The researchers also saw those harvested credentials used to connect to internal production databases. That's the part that should worry operators most. A single exposed secret in a web application can turn a modest server compromise into access to the data the business actually cares about.

A second pattern didn't require the web server at all. Here, attackers already held valid AWS credentials obtained elsewhere, and they used them to map the environment. The goal was to uncover accounts, permissions, databases, and storage servers. Automation makes that kind of enumeration fast. An agent can query many services in quick succession, which is exactly the sort of rapid multi-service activity defenders are told to watch for.

Amazon pushed back on the framing that its platform was involved. In a statement to BleepingComputer, the company said "AWS services were not compromised and operated as designed," and that the research described attackers using credentials taken from customers' compromised applications. The company pointed customers toward least-privilege permissions, requiring IMDSv2 on EC2 instances, keeping long-term access keys out of application configurations, and enabling Amazon GuardDuty. That's a fair read of where the failure points sit. The weak link in these cases was the customer side: secrets stored where a web shell could reach them.

Where AntiFox fits: the ARTEX lineage

AntiFox is a fork of ARTEX 0.1.1, another AI-assisted penetration testing framework built by a Chinese developer. Its own history is instructive. ARTEX was released in late July 2026 by a developer using the handle Autumn-27, as an AI-powered upgrade to ScopeSentry. Censys described ScopeSentry as a widely used Chinese asset-discovery and vulnerability-scanning platform. ARTEX's popularity grew quickly, and by early October reports began linking it to real attacks. The developer distanced themselves from that misuse, moved the tool to closed source, and made no further public releases.

The closed-source move didn't end the story. Censys identified 1,465 hosts running exposed ARTEX consoles, and roughly 10% of them also ran at least one other tool commonly used in cyberattacks. The same research found 32 publicly accessible directories on ARTEX hosts, some exposing exploit binaries, post-exploitation tools, and other sensitive files. In other words, the operational infrastructure around these tools is often as exposed as the tools themselves. Researchers have since tracked ARTEX in several campaigns, including one targeting South Korean financial institutions. Microsoft observed the China-aligned group Storm-0940 using it as well. Taken together, the pattern looks less like one bad fork and more like a class of open source offensive frameworks that get repurposed quickly once they're public. Here's the thing: penetration testing frameworks are dual-use by design. The same automation that helps a red team find an exposed secret helps an intruder find one faster. Tools like Cobalt Strike and ConnectWise ScreenConnect have followed similar arcs, which is why defenders can't rely on the tool's intent or its license to predict how it will show up in an incident.

What defenders should change first

Arctic Wolf's guidance is practical rather than exotic, and that's the point. On the web tier, the researchers recommend watching for unexpected files appearing on servers and for operating-system commands running that nobody approved. Unfamiliar web shells should be removed immediately, and any affected system should be reviewed from the ground up instead of simply cleaned.

Credential hygiene is the larger job. Any exposed password, API key, or cloud credential should be rotated without delay, not only the ones that look obviously stolen. Application-level permissions should be narrowed to what normal operations require. Detailed logging matters here because it's often the only way to see the difference between a legitimate workload and an agent quietly enumerating accounts.

On the AWS side, the signals to investigate include bursts of requests spanning many services and attempts to pull stored credentials from infrastructure that doesn't normally touch them. Those patterns are noisy in isolation, but an automated agent tends to produce them in bulk, which makes baselining normal API activity more valuable than ever.

The open question is how far agent-style automation changes the economics of these intrusions. Right now the evidence points to attackers using AI tooling to compress reconnaissance and credential harvesting, not to inventing new exploitation methods. That's a meaningful speedup, and it means the window between an initial foothold and lateral movement may shrink. Watch whether the next round of reports shows AI-driven tools reaching deeper into environments before defenders notice, and whether forks of these frameworks keep appearing faster than they can be tracked.