AI Pentesting Platform AntiFox Linked to AWS Production Secret Theft
The emerging AI-powered penetration testing platform AntiFox has been implicated in attacks that successfully stole AWS production secrets and facilitated lateral movement within compromised cloud environments.
Cybersecurity researchers have uncovered a campaign where the artificial intelligence-driven penetration testing platform AntiFox has been weaponized to steal Amazon Web Services (AWS) credentials and achieve lateral movement within targeted cloud infrastructures. Arctic Wolf Labs observed instances where Alibaba Cloud systems hosting AntiFox interfaces were actively engaged in malicious actions against internet-facing services and their associated AWS environments.
The attacks chain together web exploitation techniques with the deployment of web shells to systematically discover configurations, validate credentials, enumerate cloud services, access secrets, and perform storage operations. This sophisticated approach allows threat actors to move rapidly from initial compromise to deep access within a victim's cloud footprint.
AntiFox, an open-source project available on GitHub, is designed as an autonomous penetration testing platform. Its architecture utilizes a multi-agent system comprising a planner, worker, and main agent to automate the entire engagement process, from reconnaissance and attack surface discovery to exploitation and report delivery. The platform's emphasis on delivering actionable findings differentiates it from many tools that stop at the discovery phase.
Initial access in these campaigns often begins with the compromise of an internet-facing Internet Information Services (IIS) application. Attackers then leverage this foothold to deploy an ASPX web shell, using the IIS worker process (w3wp.exe) to execute operating system commands. These commands are used to locate sensitive files like web.config and configuration backups, extract application settings and database connection strings, enumerate log directories, and attempt to access internal production databases.
Further analysis revealed that on a compromised IIS server, commands executed through w3wp.exe were used to identify the execution context, enumerate application directories, check file permissions, and test the ability to write files into the web root. The deployment of a web shell via the IIS worker process strongly suggests that the compromise originated from a vulnerability within the affected web application, though the precise vulnerability remains unknown.
In other observed attacks, threat actors started with valid AWS credentials obtained through undisclosed means. These credentials were then abused to validate identities and enumerate a wide array of AWS services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, and RDS, among others. While many of these API requests resulted in "AccessDenied" errors, some discovery and secret-access operations were successful.
Notably, the attackers were able to progress beyond mere enumeration of AWS Secrets Manager to successfully retrieve production secrets using the GetSecretValue API call. In separate instances, valid AWS identities were used for S3 bucket discovery and object manipulation via API calls. This demonstrates the potent capability of agentic frameworks like AntiFox to accelerate and standardize the application of advanced attack techniques.
The rise of AI-powered tools like AntiFox and ARTEX signifies a growing trend where threat actors are increasingly weaponizing these platforms to automate intrusion stages with minimal human intervention. This allows adversaries to adapt established tradecraft and deploy them at machine speed, drastically reducing the time from initial compromise to data exfiltration and increasing the overall efficiency of cyberattacks.