Attackers turned the AntiFox AI pentesting agent on real AWS accounts and pulled a production secret

An AI agent built to help defenders find holes was pointed at real companies instead. It broke into a web server, dug out passwords, then hammered AWS accounts until a production secret came loose.

What happened

AntiFox is an open-source, Chinese-language agentic penetration testing platform, first built as a fork of ARTEX, the agent tied to recent attacks on Korean banks. Security researchers at Arctic Wolf say attackers ran their own copies of it on Alibaba Cloud servers. In one intrusion the foothold was a hacked IIS web app: the web server process dropped an ASPX web shell, then ran commands to read web.config files, connection strings and app settings, and copied config and log files into a public upload folder. It also tried an internal production database with a password lifted from that config.

The damage

With valid AWS identities, IAM users and in some cases an assumed EC2 role, the activity sprayed List, Get and Describe calls across IAM, S3, Lambda, Secrets Manager, KMS, RDS, Bedrock and more. In one intrusion it cycled through several identities and fired hundreds of requests in about half an hour. Most got AccessDenied. Some didn't: a GetSecretValue call against a production secret succeeded, and elsewhere a valid identity read, copied and deleted S3 objects.

How it was caught, and what happened next

Amazon said AWS services were not compromised and worked as designed, and that the attackers used credentials taken from customers' compromised apps. The researchers say to kill unknown web shells and rotate every key and password that sat in config files.