Science & Tech · Cybersecurity · 4 hrs ago
Attackers Used AntiFox to Target Web Servers and AWS Accounts
Attackers used AntiFox, an automated penetration-testing platform, in attacks on internet-facing web services and AWS accounts.
Security researchers linked the activity to AntiFox interfaces hosted on Alibaba Cloud, but said they could not determine how attackers obtained some AWS credentials.
In one case, attackers placed a web shell on a public IIS server and used it to inspect application settings and copy configuration files and logs.
Using valid AWS identities, they rapidly checked accounts and services, making hundreds of requests in about 30 minutes in one intrusion.
Most requests were blocked, but some attacks accessed production secrets or read, copied and deleted S3 data.
The concern is that automated tools can make attack techniques faster and easier to repeat.
Defenders are advised to review unusual AWS activity, revoke affected sessions and keys, and change credentials exposed in application files.
Arctic Wolf researchers reported that attackers used AntiFox, an open-source penetration-testing platform, to target internet-facing web services and AWS environments.
The AntiFox-linked infrastructure was hosted on Alibaba Cloud.
In some incidents, attackers deployed an ASPX web shell on an IIS server and collected application settings, database details, configuration files and logs.
The attackers also used valid AWS identities to rapidly probe services, and some requests succeeded in accessing production secrets or S3 data.
Researchers warned that automated penetration-testing frameworks can make attack techniques faster and more consistent.
- Who
- Attackers using AntiFox-linked infrastructure targeted web services and AWS environments.
- What
- They deployed an IIS web shell and used valid AWS identities to enumerate services, access some production secrets and handle S3 objects.
- When
- Arctic Wolf observed the intrusions recently; the articles were published on November 11, 2026.
- Where
- Internet-facing IIS servers and AWS environments; the AntiFox infrastructure was hosted on Alibaba Cloud.
- Why
- Not stated
This story does not have two clearly opposing sides.
Security Affairs and BleepingComputer published reports on Arctic Wolf’s findings.
Attackers used AntiFox-linked Alibaba Cloud systems to target internet-facing web services and AWS environments.
Attackers cycled through multiple AWS identities and made hundreds of API requests in about 30 minutes.
- Platform
- AntiFox, an open-source agentic penetration-testing tool
- Hosting provider
- Alibaba Cloud
- Web server
- Internet-facing IIS server
- AWS activity
- Hundreds of API requests in about 30 minutes in one intrusion
- Accessed data
- Production secrets and, in a separate incident, S3 objects
3 sources
What people are saying
Arctic Wolf is tracking the emerging use of self-hosted agentic penetration testing frameworks, including AntiFox, from public cloud infrastructure.
In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments,