Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.

"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said in a report shared with The Hacker News.

The activity has been observed chaining together web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations.

AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform. As of writing, the project has been forked 251 times and starred 474 times.

Given an authorized target, a planner / worker / main-agent multi-agent system runs the full engagement over a dual-graph core (a global asset graph + a per-task exploration graph) — recon → attack-surface discovery → exploitation → finding capture → report delivery — fully observable, interactive, and deliverable

Unlike most automated pentest tools that are "great at discovery, but stop at discovery," AntiFox puts its weight on delivery — turning what the AI finds into a report that an engineer can understand, reproduce, back with evidence, and hand straight to the client.

According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application.

Source link