Arctic Wolf Says Attackers Ran AntiFox AI Agents From Alibaba Cloud to Reach AWS Secrets
Arctic Wolf says Alibaba Cloud servers hosting the open-source AntiFox AI pentest platform were tied to intrusions that mostly hit access denied errors but still pulled a production secret from AWS.
Somebody took an open-source AI tool built to run penetration tests, parked it on rented servers in Alibaba Cloud, and pointed it at real companies. That is the short version of a threat alert Arctic Wolf Labs published on November 10, and the uncomfortable part is not that most of the attempts failed. It is that a few of them did not, and one ended with a production secret pulled out of an AWS account.
The tool is AntiFox, a Chinese-language agentic pentesting platform that, according to BleepingComputer, started life as a fork of ARTEX 0.1.1 and has since been updated to version 2.0. It lets users spin up AI agents that map exposed services and probe them for weaknesses. The Hacker News counted 251 forks and 474 stars on GitHub.
"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments." Arctic Wolf Labs
Note the wording. Arctic Wolf says the infrastructure was associated with the attacks. Its published alert does not name who ran the AntiFox consoles, does not give a victim count beyond "several" intrusions, and warns that public cloud addresses can be reassigned or shared with unrelated tenants. Alibaba Cloud's role here is Arctic Wolf's account of where the servers lived. No response from Alibaba appeared in any of the reporting we reviewed.
Mostly denied, not entirely
Arctic Wolf describes two ways in. In some cases the foothold was a compromised internet-facing Microsoft IIS web application, where the attacker planted a web shell and went hunting through configuration files for settings and database connection strings. Arctic Wolf says it never identified the exact vulnerability that gave the attacker code execution. In other cases the intruder simply showed up with a valid AWS credential, obtained, in the firm's words, "through unknown means."
From there it looked like software that never gets bored. Arctic Wolf says the AntiFox-linked source used legitimate IAM users and, in some instances, an assumed EC2 role. In one intrusion it cycled through multiple AWS identities and fired off hundreds of cross-service requests in roughly half an hour, sweeping storage, databases, serverless functions, key management and even Amazon Bedrock.
Most of those requests bounced. Arctic Wolf says the majority came back as access denied. But successful discovery and secret-access operations were mixed into the same burst, and in at least some instances the activity reached a successful read of a production secret in AWS Secrets Manager. In separate activity, a valid AWS identity was used to read, copy and delete objects in S3 storage. The alert does not say which secret was taken, what the storage held, or what was deleted.
That gap between "mostly blocked" and "got the secret" is the real lesson. Arctic Wolf explicitly tells defenders not to assume a sequence failed just because most requests were denied.
"Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks." Arctic Wolf Labs
This is a separate case from the ARTEX campaigns that have dominated security news lately, even if the family tree overlaps. ARTEX itself went closed-source after it was used against South Korean banks, BleepingComputer notes, and Microsoft recently described an ARTEX agent that went from a GitHub leak to Key Vault data in five minutes. AntiFox is still sitting on GitHub. Its publishers say it must not be used against live systems or for illegal activity, but BleepingComputer found no technical controls that enforce those rules. A polite README is not a safeguard.
Arctic Wolf's advice is unglamorous and sensible. Watch for AWS access from hosting providers an identity has never used, look hard at the successful calls buried inside bursts of denials, revoke affected sessions and keys, and rotate anything exposed in application config files.
The bigger worry is economics. Tools like AntiFox turn a tiring job into something an operator hands to a fleet of agents. Defenders have to be right every time. The agents only need the one request that gets through.
