AntiFox: an agentic pentest platform reached a live AWS secret

01What happened

Arctic Wolf Labs published an alert on November 10, 2026 about intrusions it links to AntiFox, an open-source, Chinese-language agentic penetration testing platform. The team found Alibaba Cloud systems running AntiFox web consoles connected to attacks on internet-facing web services and on the AWS accounts behind them. Arctic Wolf names no victims.

02How it works

Two entry paths appear in the alert. In one, a compromised IIS application let the w3wp.exe worker process write an ASPX web shell, which then read web.config files and connection strings and copied configuration and log files into a web-accessible upload directory. In the other, the operator already held a valid AWS credential and used it for List, Get and Describe calls across unrelated services. Arctic Wolf describes one source rotating through several AWS identities and making hundreds of cross-service requests in about 30 minutes.

03Who is affected

Exposure here sits with organizations running internet-facing IIS applications and AWS accounts that issue long-lived credentials, not with users of any AI product. Arctic Wolf did not identify the vulnerability behind the web compromise, and says the AWS credential in the second path was obtained by unknown means.

04What to do

Alert on a successful GetSecretValue that follows a burst of denied calls, and on AWS API activity from hosting-provider networks never before tied to that identity. Arctic Wolf also advises watching for w3wp.exe spawning cmd.exe or powershell.exe, rotating credentials found in configuration files, deployment artifacts and debug logs, and enforcing IMDSv2 with least-privilege policies.

Questions people ask

Does the AntiFox activity mean AWS itself was breached?

No. Arctic Wolf Labs describes intrusions into customer environments, reached either through a compromised IIS application or through a valid AWS credential obtained by unknown means. The successful GetSecretValue call used a customer identity rather than a flaw in an AWS service. Arctic Wolf does not identify the vulnerability behind the web compromise, and does not name the organizations involved.

How can defenders spot AntiFox-style AWS enumeration?

Arctic Wolf advises alerting when one source address uses several access keys, IAM users or assumed roles in a short window, and on fast List, Get and Describe sequences across unrelated services from Boto3 or Botocore. The alert stresses not dismissing such a burst because most calls were denied, because successful calls sit between the denials.

Which indicators did Arctic Wolf publish for AntiFox?

Arctic Wolf lists two source addresses, a web console on TCP/8787, a banner hash, and the Boto3/1.43.125 and Botocore/1.43.125 user agents. On Windows hosts the alert names w3wp.exe spawning cmd.exe, powershell.exe or where.exe, along with new .aspx files and copied configuration and log text files in web-accessible upload directories.

Sources 2 links, all fetched

1. 1github.comArctic Wolf Alert
2. 2labs.cloudsecurityalliance.orgCSA Research Note