What happened
On 2026-11-12 Arctic Wolf and GitGuardian disclosed that threat actors are abusing AntiFox, an open-source AI pentesting platform forked from ARTEX 0.1.1, to automate credential theft. Attackers hosted AntiFox on Alibaba Cloud, used its agents to deploy webshells on internet-exposed IIS servers and search app config for DB credentials, then used valid AWS identities to make hundreds of API calls — most denied, some succeeding to read production secrets and access S3 objects.
Why it matters
This is the attacker-side of the AI-agent risk: a commodity open-source AI agent platform (ARTEX and its forks, plus hundreds of exposed consoles) is now a tool for automated credential theft and cloud compromise. It directly threatens the cloud accounts hosting AI workloads (Bedrock, Lambda, S3) and shows that unsecured AI pentest tooling is itself an attack surface.
Attack vector
Attackers host their own AntiFox instance on Alibaba Cloud and use its AI agents to automate service mapping and endpoint probing, deploy ASPX webshells on internet-facing IIS servers, harvest DB connection strings/app config, then use valid (previously exposed) AWS identities to test permissions across S3/EC2/Lambda/Secrets Manager/Bedrock and read production secrets.
Affected systems
AntiFox (an open-source AI pentesting platform forked from ARTEX 0.1.1) and exposed ARTEX consoles; internet-facing IIS servers; AWS accounts holding production secrets.
Mitigation
Investigate bursts of denied AWS calls followed by successful secret reads; revoke affected AWS sessions/access keys and rotate exposed app credentials; remove web shells (pwn*.aspx) and staged config/log files (cfg*.txt/wc*.txt/el*.txt); require IMDSv2 and least-privilege; audit exposed ARTEX consoles (TCP/8787) and unknown boto3/1.43.125 activity.