Cybersecurity researchers have identified attacks in which cybercriminals allegedly misused AntiFox, an open-source artificial intelligence-based penetration-testing platform, to target Amazon Web Services (AWS) environments. The incidents highlight growing concerns about the misuse of agentic AI tools to automate cyber operations and access sensitive cloud infrastructure.
According to findings from cybersecurity firm Arctic Wolf, infrastructure associated with AntiFox and hosted on Alibaba Cloud was involved in suspicious activity targeting internet-facing systems and AWS services.
The reported attacks involved attempts to exploit exposed web servers, obtain sensitive configuration information and use compromised cloud credentials to access additional resources. Researchers also identified activity involving legitimate AWS identities, suggesting that attackers had obtained credentials before attempting to access deeper parts of affected environments.
AntiFox-Linked Infrastructure Identified in AWS Attacks
AntiFox is an open-source agentic penetration-testing platform designed to automate security assessment activities. Its capabilities include identifying exposed systems, mapping network environments and examining potential vulnerabilities.
Researchers observed suspicious activity originating from systems associated with AntiFox interfaces hosted on Alibaba Cloud. These systems were reportedly used in operations targeting AWS environments.
One important finding involved authenticated requests to AWS service endpoints using valid Identity and Access Management (IAM) credentials and, in some cases, Elastic Compute Cloud (EC2) roles.
This distinction is significant because authenticated access can allow an intruder to interact with cloud resources beyond what would normally be possible through external scanning alone.
The reported activity demonstrates how compromised identities can become a security risk even when organisations have perimeter protections in place.
Webshell Activity Raised Concerns Over Server Security
In one incident described by Arctic Wolf, attackers reportedly placed an ASPX webshell on an internet-facing Microsoft Internet Information Services (IIS) server.
A webshell is a malicious script that can provide unauthorised remote access to a compromised web server. Its presence can expose application information and create opportunities for further intrusion.
Investigators found evidence that the attackers accessed operating-system and application information. They also reportedly obtained database connection strings containing sensitive authentication details.
Server configuration files and logs were copied into a directory accessible through the web, potentially exposing information that could be used in further attacks.
The incident illustrates why organisations need to monitor unusual changes to web-server files and protect sensitive configuration data from being exposed through public-facing directories.
Unusual AWS API Activity Exposed Sensitive Secrets
Another incident involved the use of valid IAM credentials and EC2 roles to access multiple AWS service endpoints.
According to the researchers, hundreds of API requests were made across several identities within approximately 30 minutes during one intrusion.
Although security controls blocked most of the attempts, some requests reportedly succeeded. This allowed the attackers to retrieve sensitive production secrets.
Such secrets can include API keys, access tokens and database passwords used by applications and cloud services. If exposed, they may provide access to interconnected systems and business-critical resources.
In a separate incident, attackers reportedly used valid AWS identities to read, copy and delete files and objects stored in Amazon Simple Storage Service (S3) buckets.
These findings indicate that the reported activity went beyond basic vulnerability discovery and involved attempts to interact directly with cloud data and resources.
Growing Security Concerns Around Agentic AI Tools
AntiFox is described as an open-source platform developed as a fork of ARTEX 0.1.1. It includes a Chinese-language interface and supports AI agents capable of performing multiple security-testing tasks.
Unlike conventional tools that generally require operators to carry out individual steps, agentic AI systems can coordinate a sequence of activities towards a defined objective.
Such automation can be useful for authorised security assessments, but it also creates risks when the same capabilities are used against systems without permission.
The AntiFox case follows concerns about the misuse of ARTEX, another AI-based security-testing framework. The supplied report also references earlier findings linking ARTEX-related activity to campaigns attributed to the hacking group Vapor Panda. These historical allegations should be distinguished from the specific AntiFox incidents described by Arctic Wolf.
AntiFox remains available as an open-source project, with its version 2.0 reportedly including improvements to finding logs and report generation. Its publishers state that the platform should not be used against live systems or for unauthorised activities. However, the report raises concerns about the absence of technical safeguards capable of reliably enforcing those restrictions.
Security Measures Organisations Should Prioritise
The incidents underline the importance of monitoring both web-server activity and cloud identity usage. Organisations operating AWS infrastructure should consider the following defensive measures:
Monitor web-server integrity: Investigate unexpected changes to IIS files, application directories and server configurations.
Review cloud access activity: Examine unusual authenticated requests, unexpected API activity and access from unfamiliar infrastructure.
Protect IAM identities: Apply least-privilege permissions and regularly review access granted to users and application roles.
Secure production secrets: Store credentials in controlled secret-management systems rather than exposing them in application files or public directories.
Respond to credential exposure: Revoke compromised sessions and keys, rotate exposed credentials and investigate potentially affected cloud resources.
Maintain audit records: Preserve relevant server and cloud logs to support incident investigation and recovery.
The reported incidents reinforce a broader cybersecurity challenge: AI-powered security tools can serve legitimate defensive purposes, but their automated capabilities can also be misused. Organisations therefore need security controls that address not only external threats but also compromised identities, exposed credentials and unusual activity within trusted cloud environments.