AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

What happened

Cybersecurity researchers have identified that the AntiFox AI-driven penetration testing platform was used in attacks that accessed AWS production secrets. Attackers exploited compromised IIS servers, deploying web shells to move laterally within targeted environments. The AntiFox tool, which automates the entire penetration testing process, was hosted on Alibaba Cloud systems linked to these malicious activities. Some attacks involved using valid AWS credentials to enumerate and access various cloud services, including successful retrieval of production secrets.

Key details

• AntiFox is an AI-powered penetration testing platform available on GitHub, with 251 forks and 474 stars as of now.
• Attackers gained initial access through compromised IIS servers and deployed ASPX web shells using the w3wp.exe process.
• Commands executed included searching for configuration files, reading application settings, and attempting to connect to internal production databases.
• In some cases, valid AWS credentials were used to access services like IAM, S3, Lambda, Secrets Manager, and others.
• At least one incident involved a successful GetSecretValue API call, retrieving a production secret from AWS Secrets Manager.

Why it matters

Organizations using AWS and running internet-facing IIS servers are at risk of having their cloud credentials and secrets stolen if targeted by attackers misusing AntiFox. This creates a direct threat to cloud environments, as attackers can automate intrusion steps and access sensitive data or resources. Security teams must now address the risk of AI-driven tools being leveraged for unauthorized access and data theft in cloud infrastructures.