Hackers use AntiFox AI agents in AWS credential-theft attacks

Attackers are leveraging AntiFox, an open-source AI agentic penetration testing tool, hosted on Alibaba Cloud to systematically exploit valid AWS identities and EC2 instance roles — meaning stolen or abused legitimate credentials are doing the damage, not brute force. Once inside, the agents automate vulnerability scanning, webshell deployment, secret harvesting, and S3 manipulation, dramatically accelerating the attack lifecycle. The core failure is that legitimate AWS credentials and roles were either over-privileged or insufficiently monitored, allowing attackers to blend in with normal cloud activity. This matters because AI-driven attack agents can execute complex, multi-stage cloud intrusions far faster than defenders can manually detect them, making correlation of signals across web and cloud layers critical.