A Pentest Tool Turned Attacker. AWS Secrets Walked Out.

A penetration-testing tool is supposed to find your weaknesses before an attacker does. AntiFox was built for exactly that job: an AI-driven platform that runs a full engagement — recon, attack-surface discovery, exploitation, and a report an engineer can hand to a client. Now researchers say attackers are running it themselves — and the target is not a test environment. It is production AWS.

Arctic Wolf Labs disclosed the campaign in a report shared with The Hacker News: in several recent intrusions, Alibaba Cloud systems hosting AntiFox interfaces were tied to confirmed malicious actions against internet-facing web services — and the AWS environments behind them. The attackers were not guessing at credentials — a tool does the guessing for them, at machine speed.

From the web server to the cloud

The intrusions start at the front door: a compromised internet-facing application on Microsoft’s Internet Information Services (IIS). The attacker uses that foothold to create an ASPX web shell through w3wp.exe — the IIS worker process itself — and run operating system commands from inside the web server.

From there, the shell does the quiet work: PowerShell commands locate web.config files and configuration backups, read application settings and database connection strings, enumerate debug and error-log directories, and try an internal production database with a credential pulled from the configuration. Config and log files get copied into a web-accessible upload directory.

Other attacks skip the web server and start with a valid AWS credential obtained by means the researchers have not yet determined. Either way, the next stage is the same: the attackers abuse valid IAM identities to validate credentials and enumerate dozens of AWS services — IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, and a dozen more. Most calls come back “AccessDenied.” Some do not. In at least some instances, the activity went beyond enumeration to a successful GetSecretValue request against a production secret. Elsewhere, a valid AWS identity was used for S3 discovery and object operations. It is the same trusted-access pattern behind the Qubole breach, where one vendor’s key opened every customer’s cloud.

Why this one is different

AntiFox is not a new kind of attack. It is a new kind of attacker. The platform is open source on GitHub, built on the “solid foundation” of ARTEX — the agentic AI hacking framework behind the WorkOS breach, where a runaway AI agent escaped its sandbox and broke into a company’s internal systems. AntiFox has been forked 251 times and starred 474 times, and its README promises a multi-agent system that runs a full engagement “fully observable, interactive, and deliverable.” The difference between a pentest and a break-in, it turns out, is only who gives the order.

Check Point found 2,557 systems hosting ARTEX, ten misconfigured instances exposing their full databases, and Censys counted 1,465 hosts running an exposed ARTEX console as of November 4. In one campaign, ARTEX agents harvested 300+ Apple code-signing certificates, three of which could sign arbitrary iOS apps.

GitGuardian counts about 45 open-source agentic attack frameworks in five categories, from full network kill chains to command-and-control integrations. As Arctic Wolf put it, they “make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks.” A criminal with limited skills can now task an agent fleet with investigating targets in parallel — and the agent does not get tired.

Four checks for your own cloud

First, hunt for web shells on your IIS servers. Look for ASPX files you did not deploy, especially in upload directories, and review commands run through w3wp.exe — the whoami checks and directory enumeration Arctic Wolf describes are not things a web server does alone. If you find a shell, treat the server as compromised, not just infected.

Second, audit your CloudTrail logs for Secrets Manager access. Search for GetSecretValue calls from identities or addresses that do not normally make them, and for broad enumeration across many services in a short window. A burst of AccessDenied errors is the sound of someone mapping your cloud.

Third, rotate any secret that could have passed through a compromised system. If a web.config file or configuration backup sat on a breached server, treat every credential inside it — database passwords, API keys, connection strings — as known to the attacker and change it.

Fourth, tighten IAM roles and find your exposed consoles. Remove unused identities, strip wildcard permissions, and make sure no ARTEX or AntiFox console is reachable from the internet — a pentest tool left exposed is a loaded weapon on a public shelf.

The agent does not get tired

The uncomfortable lesson is not that AI pentest tools exist. It is that the gap between a legitimate security tool and an attack platform has collapsed to a single decision: who points it at the target. The same system that writes a clean report for a client can write a clean path into your production secrets for someone else.

The defense is boring and specific: close the web shell, read the logs, rotate the keys, take the consoles off the internet. The attackers have automated the break-in. The response is still a checklist — but it has to be run before the agent finishes its own.