MalwareNov 11, 2026

AI Pentest Tool AntiFox Abused To Steal AWS Credentials

Attackers abuse AntiFox AI pentest tool to steal AWS credentials and target IIS servers.

Attackers are leveraging the open-source, Chinese-language penetration testing platform AntiFox to target IIS servers and AWS accounts. Arctic Wolf Labs observed intrusions where AntiFox, hosted on Alibaba Cloud, was used to gain access to web services and cloud environments. The tool automates attack steps, enabling attackers to steal database credentials from IIS configurations and enumerate AWS resources, including IAM, EC2, and S3, to access secrets and data.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Alibaba Cloud?

Get an email when a new story names Alibaba Cloud, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Attackers used the open-source AI-assisted pentesting tool AntiFox to automate the extraction of database credentials embedded in IIS server configurations, then pivoted to enumerate and access AWS resources including IAM, EC2, and S3. The root problem is twofold: sensitive credentials were stored in plaintext or easily accessible IIS configuration files, and AWS IAM permissions were overly broad, allowing enumeration and data access once credentials were compromised. This incident illustrates how automated tooling dramatically lowers the skill bar for attackers, turning a misconfigured web server into a full cloud account takeover. Organizations that treat cloud credential hygiene and least-privilege IAM as optional housekeeping tasks face existential risk to their cloud-hosted data and infrastructure.

What helps against this

How we list vendors

Arctic Wolf research Microsoft affected

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleMicrosoft Defender for Identity Okta Identity Threat Protection Huntress Managed ITDR all options
Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
For exampleCrowdStrike Falcon Cloud Security Palo Alto Networks Cortex Cloud Orca Security Orca Cloud Security Platform all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleCrowdStrike Falcon Insight XDR ESET PROTECT Huntress Managed EDR all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — AntiFox

Entities

AntiFox (product)IIS (technology)AWS (technology)Alibaba Cloud (vendor)Arctic Wolf (vendor)