Attackers used AntiFox, an open-source AI hacking agent, to reach AWS production secrets

Security company Arctic Wolf says attackers have been running AntiFox, a free, open-source “AI penetration testing” platform, from servers on Alibaba Cloud and using it in real intrusions. In the cases it describes, the agents started at a hacked web server or a stolen cloud key and worked their way to production secrets in Amazon Web Services (AWS) accounts. The Hacker News and BleepingComputer reported the findings on November 11, 2026. Here’s what was seen and what cloud teams should check.

What AntiFox is

AntiFox is a multi-agent tool, published on GitHub with a Chinese-language interface, that plans and runs an attack from reconnaissance through exploitation to a written report. It began as a fork of ARTEX, the AI attack framework that Microsoft linked to the ConnectWise campaign and that WorkOS’s CEO said was used in the attack on its sales tool. AntiFox’s authors forbid using it against live systems or for illegal activity, but BleepingComputer notes they don’t describe any technical controls that enforce that.

What Arctic Wolf saw

Arctic Wolf says Alibaba Cloud systems hosting AntiFox interfaces were linked to confirmed malicious activity against internet-facing web services and the AWS accounts behind them. Two patterns stand out:

• From a web server to secrets. On a compromised Microsoft IIS server, a web shell was created by the IIS worker process, which suggests the web application itself was exploited. The attackers then hunted for web.config files and backups, read database connection strings, tried a database password they found, and copied configuration and log files into a folder they could download from. Arctic Wolf doesn’t know which flaw was used to get in.
• From a stolen key to the whole account. In other cases the attackers started with a valid AWS credential obtained in an unknown way, or an EC2 role, and used it to probe dozens of AWS services, from IAM and S3 to Secrets Manager, Lambda and Bedrock. In one intrusion they cycled through several identities and made hundreds of API calls in about 30 minutes, BleepingComputer reports.

Most of those calls were refused. Some weren’t: in at least some cases the attackers made a successful GetSecretValue request against a production secret, and in another a valid identity was used to read, copy and delete objects in S3.

What Amazon says

In a statement added to BleepingComputer’s story, an Amazon spokesperson said AWS services “were not compromised and operated as designed,” and that the research describes attackers using credentials taken from customers’ compromised applications. Amazon recommends least-privilege permissions, requiring IMDSv2 on EC2, keeping long-term access keys out of application configuration and turning on GuardDuty.

Why it matters

None of these techniques is new. What tools like AntiFox change is speed and scale: an attacker with modest skills can point a fleet of agents at many targets and let them grind through long chains of small mistakes, such as a password in a config file or an over-permissive role, that a human might not have time to try. The Hacker News notes that more than 1,400 internet-exposed ARTEX consoles were counted in early November, though not all are necessarily malicious.

What you can do

If you run web applications that connect to AWS:

1. Get keys out of config files. Don’t keep long-term AWS access keys or database passwords in web.config or .env files on a web server. Use roles and a secrets manager, and give each role only what it needs.
2. Require IMDSv2 on EC2 instances so a web shell can’t easily lift the instance’s role credentials.
3. Watch for bursts. Arctic Wolf suggests looking for a burst of AccessDenied errors across many services from one identity, then checking the few calls in that burst that succeeded.
4. Connect the dots. Correlate web shell or odd IIS worker activity with unusual AWS API calls from the same application’s identity.
5. If you find this activity, revoke the affected sessions and keys, and rotate every credential that was readable on the compromised server.

How Frame helps

This is about stolen cloud credentials at companies, not a list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t monitor cloud accounts.

Related coverage

• Stolen Qubole credentials opened dozens of companies’ AWS accounts: another recent case of AWS access through credentials rather than an AWS flaw.
• Symantec: AI helped attackers revive a stalled break-in at a US retailer: research published this week on how attackers use AI during live intrusions.
• WorkOS says an AI-assisted attack reached its sales tool: the earlier ARTEX case.

Sources

• The Hacker News, AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets, November 11, 2026
• BleepingComputer, Hackers use AntiFox AI agents in AWS credential-theft attacks, November 11, 2026, updated with Amazon’s statement