Attackers used servers running AntiFox, an open-source AI penetration testing platform, to break into internet-facing Microsoft IIS web servers and then pull a production secret out of victims’ Amazon Web Services (AWS) accounts, according to a new alert from Arctic Wolf Labs.
In a Pack Alert dated Nov 10, 2026, the company said that “in several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments.”
Arctic Wolf did not say how many organizations were hit, which sectors they belong to or when the intrusions began. It also did not name a threat actor or link the activity to any known group.
What AntiFox is
AntiFox lives in a public GitHub repository created on Oct 9, 2026. Its README describes “an AI-driven autonomous penetration testing platform” in which planner, worker and main agents run an engagement from reconnaissance and attack surface discovery through exploitation, finding capture and report delivery. It runs on an Anthropic or OpenAI API key and serves its web console on port 8787 by default. The latest release, v2.0.3, shipped on Oct 30.
The README says AntiFox is a fork of version 0.1.1 of ARTEX, the Chinese agentic pentesting framework that CrowdStrike tied to the Vapor Panda espionage campaign against more than 200 organizations. By Nov 11, the repository had more than 500 stars and more than 260 forks.
The project’s own license section states that AntiFox “is for personal study, code research, and local technical validation only” and “must not be used to perform actual testing against any online system or website.” The AntiFox maintainers had not issued any public statement about the Arctic Wolf findings at time of publication.
From IIS web shell to cloud keys
In some cases, the foothold was a compromised IIS application. Endpoint telemetry showed the IIS worker process w3wp.exe creating an ASPX web shell and then running operating system commands. Arctic Wolf said it could not identify the exact vulnerability that gave the attacker code execution, and it named no CVE.
Through the shell, the attacker ran whoami and icacls to check permissions, tested whether it could write into the web root and hunted for web.config files and configuration backups. PowerShell commands then used .NET configuration classes to parse database connection strings and application settings. The attacker copied configuration and log files into a web-accessible upload folder and tried to log in to an internal production database with a credential taken from the configuration.
In other cases, the intrusion began with a valid AWS credential that the attacker had obtained through unknown means.
Hundreds of AWS calls in 30 minutes
With valid IAM users, and in some cases an assumed EC2 role, the AntiFox-linked servers probed dozens of AWS services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS and Amazon Bedrock. In one intrusion, a single source cycled through multiple AWS identities and sent hundreds of cross-service API requests in about half an hour.
Most of those requests failed with AccessDenied errors, but successful calls were mixed into the same bursts. In some cases, the activity moved from Secrets Manager enumeration to a successful GetSecretValue request against a production secret. In other activity, a valid identity listed S3 buckets and objects and then ran GetObject, CopyObject and DeleteObject operations. Arctic Wolf did not say what the secret protected or what data the buckets held.
The alert does not describe any flaw in AWS itself, since the attacker used credentials and roles that already had access. The pattern echoes recent cloud intrusions such as the abuse of Qubole’s trusted AWS access to steal customer secrets and the Railway attack in which an intruder decrypted customer secrets in a hunt for AI API keys.
Indicators Arctic Wolf shared
Arctic Wolf listed 2 Alibaba Cloud source addresses, 47[.]79[.]4[.]33 and 8[.]208[.]101[.]210, along with the AntiFox console title, a banner hash, port TCP/8787 and the user agents Boto3/1.43.125 and Botocore/1.43.125. File patterns include pwn*.aspx and cfg*.txt in upload folders. The company warned that the list is not complete, that AntiFox is public and that cloud addresses can be reassigned to unrelated tenants.
How to hunt and harden
Arctic Wolf recommends that defenders:
- Flag AWS API calls from hosting providers or networks an identity has never used, and a single IP using several keys, users or roles in a short window
- Treat bursts of
List,GetandDescribecalls across unrelated services as suspicious even when most are denied - Alert on successful
GetSecretValuecalls from new infrastructure - Hunt for
w3wp.exespawningcmd.exe,powershell.exe,whoami.exeoricacls.exe, and for new.aspxfiles in upload or temp folders - Isolate any affected web server, preserve logs and memory, and remove unauthorized ASPX files
- Rotate every credential exposed in
web.config, app settings, logs and backups, and revoke active AWS sessions and keys - Enforce IMDSv2, apply least privilege, and enable CloudTrail S3 data events, S3 versioning and Object Lock where it fits
AntiFox joins a fast-growing set of AI agent tools that attackers have turned against real targets, including the agentic techniques behind the Chainalysis data breach and the AI-assisted attack on WorkOS. Arctic Wolf warned that frameworks like these make pentesting techniques “more accessible to threat actors” while raising the speed and consistency of live attacks.
