Arctic Wolf Labs has linked infrastructure hosting AntiFox, an open-source agentic penetration-testing platform, to web-server intrusions and AWS account abuse. Its November 10 report documents successful access to a production secret alongside extensive cloud-resource discovery.
In one intrusion, the infrastructure cycled through multiple AWS identities and generated hundreds of API requests in approximately half an hour. Most requests were denied, but successful operations included retrieving a secret through AWS Secrets Manager.
Researchers also observed an IIS web server creating an ASPX web shell and running commands to locate application configuration files and credentials. The initial code-execution vulnerability was not identified.
The infrastructure link does not establish that an AI model autonomously directed every stage. In a November 12 statement to BleepingComputer, Amazon said AWS services were not compromised and attackers had used credentials taken from customers’ compromised applications.
Arctic Wolf recommends correlating web-server activity with CloudTrail records and reviewing successful calls within bursts of denials. Defenders should rotate exposed application secrets and revoke affected AWS sessions and access keys.
