AntiFox, an Agentic Pentest Tool, Linked to AWS Secret Access (Arctic Wolf)

Arctic Wolf Labs says an emerging agentic penetration testing platform, AntiFox, has been linked to real intrusions, including cases where a production AWS secret was successfully retrieved. In a report dated 10 November 2026, the company describes Alibaba Cloud systems that hosted AntiFox interfaces and were “associated with confirmed malicious actions against internet-facing web services and associated AWS environments”. Our inference: the AntiFox link rests on that infrastructure association. Arctic Wolf does not say AntiFox itself executed each command. The Hacker News covered the report on 12 November.

This is another case of a dual-use agentic framework showing up in attacker infrastructure, after the ARTEX activity we have covered, including Check Point’s look at exposed ARTEX panels. All details below come from Arctic Wolf’s report and The Hacker News coverage of it. We have not analysed AntiFox ourselves.

What AntiFox is

Arctic Wolf calls AntiFox an open-source, Chinese-language agentic pentesting platform. The project README, quoted by The Hacker News, describes a planner / worker / main-agent system that runs recon, attack-surface discovery, exploitation, finding capture and report delivery. The AntiFox README describes it as a fork that started from v0.1.1 of the open-source ARTEX project, and The Hacker News reports 251 forks and 474 stars. Arctic Wolf does not mention ARTEX in the report text we read.

What Arctic Wolf observed

The activity chained web exploitation, web shell deployment, configuration discovery, credential validation, cloud-service enumeration, secret access and storage operations.

In some activity the foothold was associated with a compromised internet-facing IIS application. The IIS worker process (w3wp.exe) created an ASPX web shell and then ran commands, including whoami, icacls, and PowerShell that parsed web.config connection strings and application settings. The actor also tried to connect to an internal production database with a credential taken from that configuration, and copied configuration and log files into a web-accessible upload directory. Arctic Wolf says it could not identify the vulnerability behind the initial code execution.

In other activity, which Arctic Wolf presents separately, the actor began with a valid AWS credential obtained through unknown means. Arctic Wolf reports AntiFox-linked infrastructure cycling through multiple AWS identities and making hundreds of cross-service API requests in about half an hour in one intrusion. Arctic Wolf says the activity enumerated dozens of services across the affected AWS environments, from IAM, EC2 and S3 to Secrets Manager and Amazon Bedrock. Most requests were denied. Some were not: in at least some instances the activity reached a successful GetSecretValue request against a production secret, and elsewhere a valid identity was used for S3 GetObject, CopyObject and DeleteObject calls.

Why it matters

Arctic Wolf’s general assessment is that frameworks like this “make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks”. The report says “several” intrusions were observed and, in the text we read, gives no victim count, sector or attribution. It does not say the secret was exfiltrated or used. Our assessment: the useful lesson is not the AI layer but how little it took once credentials were reachable. Broad List, Get and Describe sweeps are noisy, yet the successful calls were mixed in with the denials.

What defenders can check

Arctic Wolf’s hunting guidance includes:

• AWS API activity from hosting providers or ASNs not previously tied to that identity, and one source IP using several access keys or roles in a short window.
• Rapid List, Get and Describe sequences across unrelated services. Confidence increases when they come from a novel hosting ASN and use Boto3, Botocore or another scripting-oriented SDK. Do not assume a sequence was unsuccessful because most calls were denied.
• On Windows web servers, w3wp.exe spawning cmd.exe or powershell.exe, and new .aspx files in upload or temp directories.

Its defensive notes add alerting on successful GetSecretValue from novel infrastructure, particularly after broad enumeration or access-denied activity, and cover rotating anything exposed through web.config and backup files, enforcing IMDSv2, least-privilege application identities, and S3 versioning or Object Lock to limit unauthorised deletion. Arctic Wolf lists two source IPs, the TCP/8787 port and the interface title in its report; take the current list from the report, since cloud addresses get reassigned.

Limits

This rests on one vendor report plus trade-press coverage. We could not independently verify Arctic Wolf’s telemetry, and the report says only “several” intrusions without a count. It also lists a banner hash, file patterns and Boto3/Botocore 1.43.125 user agents that we do not reproduce.

References

• Arctic Wolf Labs, AntiFox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally (2026-11-10)
• The Hacker News, AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
• AI Security Wire, Check Point on ARTEX operators and exposed panels