AI pentest tool AntiFox abused to steal AWS credentials

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Organisations running IIS servers and AWS accounts targeted by AntiFox attacks

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed

The Brief

Arctic Wolf Labs reported attackers abusing AntiFox, an open-source, Chinese-language agentic penetration testing platform.
Attackers used AntiFox to target IIS servers and AWS accounts.
The framework chains attack steps together, according to the research.

Why it matters

Pentest frameworks that automate multi-step attacks lower the effort needed to compromise IIS servers and steal AWS credentials, so teams running these services face a higher risk.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	Judgment: attacks hit IIS servers and AWS accounts, which ops and dev teams run.
No	Core infrastructure	Judgment: a single niche pentest platform, not core infrastructure nearly every team runs.
No	Popular tool	Judgment: AntiFox is a niche, Chinese-language open-source pentest platform, not mainstream.
Yes	Exploited in the wild	Security Affairs: Arctic Wolf saw attackers use the AntiFox platform to hit IIS servers and AWS accounts.
No	Public exploit	Security Affairs: sources describe an open-source pentest platform; no published exploit code or PoC for a flaw is stated.
No	Remote, no login	Security Affairs: sources do not state whether unauthenticated network access is needed.
No	Full takeover	Security Affairs: sources say AWS credentials were stolen but do not state code execution or full account takeover.
Yes	Secrets exposed	Security Affairs: title states attackers abused AntiFox to steal AWS credentials.
No	Supply chain	Security Affairs: sources describe abuse of an existing tool; no compromised package, update or pipeline is stated.
No	No fix yet	Security Affairs: sources do not state whether a patched version or fix exists.

Source

AI Pentest Tool AntiFox Abused To Steal AWS Credentials ↗ Security Affairs · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided