[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHpTi8Z0pmwQWcBAqsnGLA4InKfpx1O2urSD_zWHA8z8":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"cd563d8d-5a05-4e12-b6fa-a20c28bf1ec6","Hackers Abuse AntiFox AI Pentesting Tool to Deploy Webshells and Access AWS Production Secrets","hackers-abuse-antifox-ai-pentesting-tool-to-deploy-webshells-and-access-aws-prod-858104","Attackers are abusing AntiFox, an open-source AI penetration-testing platform, to compromise web applications, deploy webshells, and access Amazon Web Services production secrets. Arctic Wolf linked the activity to Alibaba Cloud infrastructure hosting AntiFox interfaces, connecting those systems to malicious actions against internet-facing applications and associated AWS environments. In one intrusion, attackers moved through multiple AWS […] The post Hackers Abuse AntiFox AI Pentesting Tool to Deploy Webshells and Access AWS Production Secrets appeared first on Cyber Security News.","Attackers are misusing the open-source AI penetration-testing platform AntiFox to compromise web applications, deploy webshells, and gain access to Amazon Web Services production secrets. Arctic Wolf linked this activity to Alibaba Cloud infrastructure hosting AntiFox interfaces. In one incident, attackers accessed AWS production secrets and in another, gained unauthorized access to S3 objects. AWS stated its services were not compromised, but attackers used compromised customer credentials.","Hackers exploit AntiFox AI pentesting tool to deploy webshells and steal AWS production secrets.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-abuse-antifox-ai-pentesting-tool\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Abuse-AntiFox-AI-Pentesting-Tool-to-Deploy-Webshells-and-Access-AWS-Production-Secrets.webp","2026-11-12T11:42:54+00:00","2026-11-12T12:00:30.561436+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"AntiFox","product",{"name":21,"type":19},"ARTEX",{"name":23,"type":24},"Amazon Web Services","vendor",{"name":26,"type":24},"Alibaba Cloud",{"name":28,"type":24},"Microsoft",{"name":30,"type":19},"Internet Information Services","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":46,"value":18,"context":56},"AI penetration-testing platform being abused by attackers.",[23,28,26],{"controls":59,"vendors":146},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":61,"product_name":77,"url":78,"description":79},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":89,"name":90,"problem":91,"products":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":118,"name":119,"problem":120,"products":121},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",[147,153,155],{"slug":148,"name":149,"logo_path":150,"roles":151},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[152],"reported_by",{"slug":139,"name":140,"logo_path":141,"roles":154},[152],{"slug":156,"name":28,"logo_path":157,"roles":158},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":170},"ai-pentesting-tool-abused-to-steal-aws-credentials-and-access-cloud-secrets","AI Pentesting Tool Abused to Steal AWS Credentials and Access Cloud Secrets","Attackers exploited the open-source AntiFox AI pentesting platform to deploy webshells on victim web applications and harvest AWS production secrets, including unauthorized access to S3 objects. The root problem was not a flaw in AWS itself, but compromised customer credentials — meaning organizations failed to adequately protect, rotate, or restrict their cloud access keys. This matters because hardcoded or poorly managed cloud credentials embedded in applications or exposed through webshells can give attackers full access to production cloud environments with minimal effort. The abuse of a legitimate security tool also highlights how dual-use software can accelerate attacker capabilities when defensive controls are weak.",[165,166,167,168,169],"NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 PR.AA-05: Access permissions and authorizations","CIS Control 6: Access Control Management","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":171,"NIST SP 800-53 AC-6: Least Privilege":172,"CIS Control 6: Access Control Management":173,"NIST SP 800-53 IA-5: Authenticator Management":174,"NIST CSF 2.0 PR.AA-05: Access permissions and authorizations":175},"This point covers human resources security, access control, and asset management, directly relevant to the failure to protect and govern AWS access credentials that attackers were able to steal and misuse.","This control requires that credentials and permissions be scoped to the minimum necessary, which would have limited the blast radius when AWS production secrets were compromised.","CIS Control 6 requires establishing and maintaining an inventory of accounts and enforcing least-privilege access, which would have constrained what attackers could do with the stolen AWS credentials.","This control mandates secure generation, distribution, storage, and rotation of credentials, which would have prevented long-lived or hardcoded AWS access keys from being harvested via webshells.","This category calls for managing and enforcing access control to protect sensitive resources, directly applicable to preventing unauthorized access to AWS production secrets through compromised credentials."]