Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said in a report shared with The Hacker News.
The activity has been observed chaining together web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations.
AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform. As of writing, the project has been forked 251 times and starred 474 times.
On its README page, the project maintainer states -
Given an authorized target, a planner / worker / main-agent multi-agent system runs the full engagement over a dual-graph core (a global asset graph + a per-task exploration graph) — recon → attack-surface discovery → exploitation → finding capture → report delivery — fully observable, interactive, and deliverable
Unlike most automated pentest tools that are "great at discovery, but stop at discovery," AntiFox puts its weight on delivery — turning what the AI finds into a report that an engineer can understand, reproduce, back with evidence, and hand straight to the client.
According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application. The access is then leveraged to create an ASPX web shell using "w3wp.exe," the IIS worker process, and run operating system commands to perform the following actions -
- Run PowerShell commands to locate web.config files and configuration backups
- Read application settings and database connection strings
- Enumerate debug and error-log directories
- Attempts to connect to an internal production database using a credential extracted from the application configuration
- Copy configuration and log files into a web-accessible upload directory
"On a compromised IIS server, commands run through w3wp.exe identified the execution context with whoami, enumerated the application directory, checked permissions with icacls, and tested the ability to write files into the web root," Arctic Wolf said.
"The creation of an ASPX web shell by w3wp.exe, followed by command execution through the same IIS worker process, suggests compromise through the affected web application."
The precise vulnerability used to achieve code execution on the IIS server is not known. In other attacks, the threat actor is said to have started with a valid AWS credential obtained through as-yet-undetermined means.
 |
| AntiFox Demo |
Specifically, this involved abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock.
While a majority of these authenticated cross-service API requests ended up with an "AccessDenied" error, some of the discovery and secret-access operations were successful, according to the cybersecurity company.
In at least some instances, the activity has been observed progressing beyond Secrets Manager enumeration to a successful GetSecretValue request against a production secret. Elsewhere, a valid AWS identity was used for S3 discovery and object operations via API calls.
"Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks," Arctic Wolf said.
The Rise of AI Tools in Cyber Attacks
The disclosure comes as threat actors are increasingly weaponizing AI-powered penetration testing tools like ARTEX to conduct broad-scale attacks across the world, enabling them to automate various stages of an intrusion with minimal human intervention.
The integration of AI has allowed adversaries, both large and small, to adapt established tradecraft and deploy them at machine speed, making it possible to progress from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes.
Earlier this week, VECERT disclosed details of a campaign dubbed Operation Ghost-Campus orchestrated by a Chinese threat actor that uses AI agents to maintain perpetual, cost-free access to large language models (LLMs) and eventually perform automated academic fraud and steal data belonging to over 5,000 students enrolled at the Fengxian Campus.
"The agent industrializes the creation of accounts on the search engine fofa.info, scans the global cyberspace for misconfigured servers, extracts API keys for OpenAI and DeepSeek, automatically verifies their financial balances, and injects them into the attacker's development environment," VECERT said.
"This stolen computing power fuels an interactive GoTTY terminal ('Pi — AI Coding Assistant') and, by extension, provides intelligence to the scripts that sustain academic fraud bots ('heartbeat' bots) and extractors of financial data and personally identifiable information (PII) belonging to thousands of students at the Fengxian Campus."
According to data from Censys, there are 1,465 hosts running an exposed ARTEX console as of November 4, 2026, with most of them located in the U.S., Hong Kong, China, Japan, Singapore, and South Korea. However, it's worth noting that not every instance is necessarily malicious in nature.
In a separate report, Check Point Research said it identified 2,557 systems that hosted ARTEX, including 10 misconfigured instances exposing their full databases.
"In many observed cases, ARTEX required remarkably little interaction from its operators once an objective had been established," Check Point said. "Rather than continuously directing attacks step by step, operators frequently issued a goal and left the agent fleet to work toward it. Human interactions were largely limited to checking progress, asking whether a target had been compromised or occasionally adjusting priorities."
The vast majority of the attacks are designed to siphon cryptocurrency, steal Apple code-signing certificates, compromise gaming accounts, and conduct denial-of-service (DoS) attacks against gambling websites. The activity has been found to exploit vulnerabilities related to weak or hard-coded passwords, missing authentication, insecure direct object references, and remote code execution.
In the campaign targeting Apple code-signing certificates, ARTEX agents searched compromised systems for certificate databases, followed by validating the stolen certificates by checking passwords, private keys, Apple revocation status, expiration dates, and associated provisioning profiles.
Ultimately, the activity is estimated to have harvested more than 300 certificates and their passwords, out of which three certificates passed the full validation process and could be used to sign arbitrary iOS applications.
The biggest change brought by agentic hacking to the cyber threat landscape is scale and speed, Check Point cautioned, as a cybercriminal with limited technical skills can task AI agents with investigating a number of targets in parallel and exploiting them using known and zero-day vulnerabilities with less manual effort.
"Its relevance to us lies in its scale, speed and persistence," CERT-EU said in an alert. "ARTEX can test large numbers of low-complexity misconfigurations, including those a human tester would notice but not have time to check, and it can work through long attack chains without the fatigue that limits manual testing."
"The same is true of complex payload crafting. Exploitation paths that need carefully tailored payloads often take more effort than the severity of the finding justifies, so a manual assessment may leave them untested."
Tools like AntiFox and ARTEX are part of a broader set of about 45 open-source agentic attack frameworks that are engineered to connect to an LLM and can act on outputs autonomously. They fall under five broad categories -
- Network kill chain capable of end-to-end reconnaissance, exploitation, and post-exploitation: PentAGI, RedAmon, and DarkMoon
- Web-app and API: Strix, Shannon, and PentestGPT
- C2-integrated: Sage, echidna, Pojun, and FORANG
- Harnesses: RAPTOR, CyberStrike, cyber-harness, Nebula and Cybermes
- Research prototypes: Incalmo, hackingBuddyGPT, VulnBot, HackSynth, AutoPT, and Ares
"Each framework has public source code and wires a model into a loop that runs tools and acts on their output," GitGuardian said.
"Agentic AI pentesting tools hand their agent a shell and web access, so the model can assemble a pipeline at runtime. A GitHub search, a scanner download, and a found key passed to the next call are all one prompt away, even though none of it ships in the repository."
