Arctic Wolf Labs published an alert on November 10, 2026 linking AntiFox, an open-source Chinese-language agentic penetration testing platform, to real intrusions that successfully read a production AWS secret. The team found Alibaba Cloud systems running AntiFox web consoles connected to attacks on internet-facing web services and AWS accounts.
Quick Take
- What: AntiFox, an open-source agentic pentesting platform, was used in intrusions that read a production AWS secret
- Entry paths: A compromised IIS application with an ASPX web shell, or a valid AWS credential obtained by unknown means
- Attack pattern: Hundreds of cross-service AWS List, Get and Describe calls in about 30 minutes, rotating through several AWS identities
- Who is affected: Organizations running internet-facing IIS applications and AWS accounts that issue long-lived credentials
- What to do: Alert on successful GetSecretValue after a burst of denied calls, and on AWS API activity from hosting-provider networks never before tied to that identity
In plain English
Researchers found that attackers used an AI-powered hacking tool called AntiFox to break into company systems and steal secrets stored in Amazon’s cloud. The attackers either broke into a web server first or already had stolen login credentials. Once inside, the tool automatically tried hundreds of different commands in about 30 minutes until it found and read a real password or key stored in AWS Secrets Manager. This is not a flaw in any AI product you use.
What you should do: If you are not a system administrator or developer managing web servers or AWS accounts, you do not need to do anything. If you do manage such systems, watch for unusual bursts of cloud API calls and rotate any credentials found in configuration files.
What happened
Arctic Wolf Labs published an alert on November 10, 2026 about intrusions it links to AntiFox, an open-source, Chinese-language agentic penetration testing platform. The team found Alibaba Cloud systems running AntiFox web consoles connected to attacks on internet-facing web services and on the AWS accounts behind them. Arctic Wolf names no victims.
Two entry paths appear in the alert. In one, a compromised IIS application let the w3wp.exe worker process write an ASPX web shell, which then read web.config files and connection strings and copied configuration and log files into a web-accessible upload directory. In the other, the operator already held a valid AWS credential and used it for List, Get and Describe calls across unrelated services.
Arctic Wolf describes one source rotating through several AWS identities and making hundreds of cross-service requests in about 30 minutes. The successful GetSecretValue call used a customer identity rather than a flaw in an AWS service. Arctic Wolf does not identify the vulnerability behind the web compromise, and does not name the organizations involved.
What you should do
Arctic Wolf advises alerting when one source address uses several access keys, IAM users or assumed roles in a short window, and on fast List, Get and Describe sequences across unrelated services from Boto3 or Botocore. The alert stresses not dismissing such a burst because most calls were denied, because successful calls sit between the denials.
Alert on a successful GetSecretValue that follows a burst of denied calls, and on AWS API activity from hosting-provider networks never before tied to that identity. Arctic Wolf also advises watching for w3wp.exe spawning cmd.exe or powershell.exe, rotating credentials found in configuration files, deployment artifacts and debug logs, and enforcing IMDSv2 with least-privilege policies.
What it means
Exposure here sits with organizations running internet-facing IIS applications and AWS accounts that issue long-lived credentials, not with users of any AI product. Arctic Wolf did not identify the vulnerability behind the web compromise, and says the AWS credential in the second path was obtained by unknown means.
Arctic Wolf lists two source addresses, a web console on TCP/8787, a banner hash, and the Boto3/1.43.125 and Botocore/1.43.125 user agents. On Windows hosts the alert names w3wp.exe spawning cmd.exe, powershell.exe or where.exe, along with new .aspx files and copied configuration and log text files in web-accessible upload directories.
