Attackers are hosting self-managed instances of AntiFox, an open-source agentic penetration testing platform, on Alibaba Cloud infrastructure and using the tool to compromise internet-facing web services and steal Amazon Web Services (AWS) credentials, Arctic Wolf Labs disclosed on November 111,2.
AntiFox lets users deploy AI agents to automate penetration-testing tasks such as mapping exposed services and probing target endpoints for vulnerabilities. Initially created as a fork of ARTEX 0.1.1, the platform has a Chinese-language interface and, as of the disclosure date, had been forked 251 times and starred 474 times on GitHub.
How the attacks unfolded
Arctic Wolf Labs observed malicious AntiFox-linked infrastructure hosted on Alibaba Cloud using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles, to make authenticated requests to AWS APIs. The infrastructure was used for vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting.
One case highlighted in the report involved deploying an ASPX webshell on an internet-exposed IIS server, executing OS commands, accessing application settings and database connection strings, and copying configuration and log files to a web-accessible directory. In one intrusion, the attacker cycled through multiple identities and made hundreds of API requests in approximately 30 minutes. Although most of those attempts were blocked, the attacker was successful in some cases and obtained production secrets, according to the report. In a separate incident, attackers used a valid AWS identity to read, copy, and delete S3 objects.
Policy gap and continued availability
AntiFox's publishers prohibit using the tool against live systems, in real-world penetration tests or security exercises, or for destructive or illegal activity, but do not describe any technical controls that enforce those restrictions, according to the reporting. The platform remains available on GitHub and has been updated to version 2.0, which reportedly improves how the tool documents and reports findings.
Arctic Wolf's report recommends revoking affected AWS sessions and keys, rotating credentials exposed through application files, correlating IIS webshell activity with unusual AWS access, and reviewing successful API calls within bursts of denials.
ANALYSIS The campaign illustrates a concrete risk of open-source agentic security tooling: a platform built to automate offensive tasks can be redeployed for real-world credential theft with no technical guardrails preventing misuse, even when the project's terms of use nominally forbid it.