AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

Cybersecurity researchers have identified malicious use of the AI-driven penetration testing platform AntiFox, which has been leveraged in attacks to steal AWS credentials and access production secrets from compromised environments. The attacks begin with exploitation of internet-facing IIS applications, leading to the deployment of ASPX web shells via the w3wp.exe process, enabling command execution and credential harvesting. The threat actors then abuse valid AWS IAM identities to enumerate and access cloud services including S3, Secrets Manager, and EC2, with confirmed successful GetSecretValue calls retrieving production secrets. The campaign highlights the growing abuse of autonomous AI-powered pentesting tools like AntiFox and ARTEX by threat actors to conduct rapid, scalable attacks with minimal human intervention.

AI-extracted · verify before operational use