Threat IntelligenceNov 12, 2026

Hackers Abuse AntiFox AI Pentesting Tool to Deploy Webshells and Access AWS Production Secrets

Hackers exploit AntiFox AI pentesting tool to deploy webshells and steal AWS production secrets.

Attackers are misusing the open-source AI penetration-testing platform AntiFox to compromise web applications, deploy webshells, and gain access to Amazon Web Services production secrets. Arctic Wolf linked this activity to Alibaba Cloud infrastructure hosting AntiFox interfaces. In one incident, attackers accessed AWS production secrets and in another, gained unauthorized access to S3 objects. AWS stated its services were not compromised, but attackers used compromised customer credentials.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Amazon Web Services?

Get an email when a new story names Amazon Web Services, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Attackers exploited the open-source AntiFox AI pentesting platform to deploy webshells on victim web applications and harvest AWS production secrets, including unauthorized access to S3 objects. The root problem was not a flaw in AWS itself, but compromised customer credentials — meaning organizations failed to adequately protect, rotate, or restrict their cloud access keys. This matters because hardcoded or poorly managed cloud credentials embedded in applications or exposed through webshells can give attackers full access to production cloud environments with minimal effort. The abuse of a legitimate security tool also highlights how dual-use software can accelerate attacker capabilities when defensive controls are weak.

What helps against this

How we list vendors

Arctic Wolf research GitGuardian research Microsoft affected

Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
For exampleBeyondTrust Password Safe ThreatLocker Privileged Access Management WALLIX PAM all options
Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleAcalvio ShadowPlex Identity Protection CrowdStrike Falcon Identity Protection Okta Identity Threat Protection all options
Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleGitHub Advanced Security Palo Alto Networks Idira Secrets Management GitGuardian Secrets Detection all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — AntiFox

Entities

AntiFox (product)ARTEX (product)Amazon Web Services (vendor)Alibaba Cloud (vendor)Microsoft (vendor)Internet Information Services (product)