# AntiFox: an agentic pentest platform reached a live AWS secret

> AntiFox, an open-source agentic pentesting platform, was used in intrusions that read a production AWS secret, Arctic Wolf Labs reports.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** Arctic Wolf
- **Disclosed:** 2026-11-10
- **Affects:** Amazon Web Services, AWS Secrets Manager, Amazon S3, Microsoft IIS, AntiFox
- **Research by:** [Arctic Wolf Labs](https://arcticwolf.com/labs/)
- **Primary source:** https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions
- **Page:** https://theinjection.dev/items/arctic-wolf-antifox-aws-secrets/

Arctic Wolf Labs ties self-hosted AntiFox consoles on Alibaba Cloud to real intrusions: a web shell on an IIS server, then valid AWS keys sweeping services until one GetSecretValue call on a production secret succeeded.

## What happened

Arctic Wolf Labs published an alert on November 10, 2026 about intrusions it links to AntiFox, an open-source, Chinese-language agentic penetration testing platform. The team found Alibaba Cloud systems running AntiFox web consoles connected to attacks on internet-facing web services and on the AWS accounts behind them. Arctic Wolf names no victims.

## How it works

Two entry paths appear in the alert. In one, a compromised IIS application let the w3wp.exe worker process write an ASPX web shell, which then read web.config files and connection strings and copied configuration and log files into a web-accessible upload directory. In the other, the operator already held a valid AWS credential and used it for List, Get and Describe calls across unrelated services. Arctic Wolf describes one source rotating through several AWS identities and making hundreds of cross-service requests in about 30 minutes.

## Who is affected

Exposure here sits with organizations running internet-facing IIS applications and AWS accounts that issue long-lived credentials, not with users of any AI product. Arctic Wolf did not identify the vulnerability behind the web compromise, and says the AWS credential in the second path was obtained by unknown means.

## What to do

Alert on a successful GetSecretValue that follows a burst of denied calls, and on AWS API activity from hosting-provider networks never before tied to that identity. Arctic Wolf also advises watching for w3wp.exe spawning cmd.exe or powershell.exe, rotating credentials found in configuration files, deployment artifacts and debug logs, and enforcing IMDSv2 with least-privilege policies.

## Quick facts

- **Reported by:** Arctic Wolf Labs, November 10, 2026
- **Framework:** AntiFox, an open-source agentic pentesting platform
- **Hosting:** Alibaba Cloud systems running the AntiFox console
- **Entry points:** A compromised IIS application, or a valid AWS credential of unknown origin
- **What succeeded:** GetSecretValue on a production secret; S3 GetObject, CopyObject and DeleteObject
- **Pace:** Hundreds of cross-service AWS calls in about 30 minutes
- **Indicators:** Console on TCP/8787, Boto3/1.43.125 and Botocore/1.43.125 user agents

## Questions

### Does the AntiFox activity mean AWS itself was breached?

No. Arctic Wolf Labs describes intrusions into customer environments, reached either through a compromised IIS application or through a valid AWS credential obtained by unknown means. The successful GetSecretValue call used a customer identity rather than a flaw in an AWS service. Arctic Wolf does not identify the vulnerability behind the web compromise, and does not name the organizations involved.

### How can defenders spot AntiFox-style AWS enumeration?

Arctic Wolf advises alerting when one source address uses several access keys, IAM users or assumed roles in a short window, and on fast List, Get and Describe sequences across unrelated services from Boto3 or Botocore. The alert stresses not dismissing such a burst because most calls were denied, because successful calls sit between the denials.

### Which indicators did Arctic Wolf publish for AntiFox?

Arctic Wolf lists two source addresses, a web console on TCP/8787, a banner hash, and the Boto3/1.43.125 and Botocore/1.43.125 user agents. On Windows hosts the alert names w3wp.exe spawning cmd.exe, powershell.exe or where.exe, along with new .aspx files and copied configuration and log text files in web-accessible upload directories.

## Sources

1. [Arctic Wolf Alert](https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions)
2. [CSA Research Note](https://labs.cloudsecurityalliance.org/research/csa-research-note-antifox-agentic-cloud-intrusions-20261112/)