Summary
- Arctic Wolf linked infrastructure hosting the AntiFox agentic penetration-testing framework to malicious activity involving web applications and AWS.
- Attackers used valid cloud identities to enumerate services, access production secrets, and manipulate stored objects.
- The initial access methods and extent of autonomous AI involvement remain unconfirmed.
Attackers have used infrastructure associated with an AI-powered penetration-testing framework during intrusions targeting internet-facing applications and Amazon Web Services environments, with researchers observing credential abuse and successful access to production cloud secrets.
Security researchers at Arctic Wolf identified malicious activity linked to systems hosting AntiFox, an open-source agentic penetration-testing platform deployed on Alibaba Cloud infrastructure.
The activity included web application compromise, remote command execution, configuration discovery, credential validation, and authenticated requests to AWS services.
In one investigation, attackers used several cloud identities to generate hundreds of API requests in approximately 30 minutes. Many requests failed because permissions were insufficient, but some succeeded, including access to a production secret.
The findings establish malicious operations associated with infrastructure hosting AntiFox, not that autonomous AI independently planned and carried out every action.
Compromised applications provided access
AntiFox is an open-source agentic security testing framework derived from ARTEX. Its capabilities include reconnaissance and automation intended for authorised penetration testing, but such tools can also be operated without permission.
Arctic Wolf observed an intrusion against an internet-facing application running on Microsoft Internet Information Services (IIS).
The attacker established a malicious server-side component that permitted command execution and subsequently examined application settings, database connection information, and accessible files.
The observed activity also included attempts to use credentials from configuration material to access an internal production database.
The specific vulnerability responsible for the original web server compromise was not identified. Researchers therefore cannot establish whether AntiFox discovered or exploited the weakness, or whether it was introduced after access had already been obtained.
Cloud identities enabled broader discovery
Separate activity involved valid AWS Identity and Access Management accounts and, in some cases, assumed EC2 roles.
Those identities were used to examine cloud resources and test which operations could be performed. The requests involved identity management, compute services, storage, databases, and other AWS capabilities.
Researchers saw repeated efforts to discover resources and use AWS Secrets Manager, including successful retrieval of a production secret.
Other activity concerned Amazon S3, where an authenticated identity was used to read, copy, and delete objects.
The findings do not establish the number of affected organisations, the full content of retrieved information, or how the cloud credentials were originally obtained.
They do show that a sequence containing many denied requests can still result in sensitive operations succeeding. Monitoring therefore needs to assess the successful calls within a broader burst of suspicious activity.
Valid authentication cannot establish legitimacy
These AWS operations did not require compromise of the cloud platform itself. The attacker used credentials and roles that were technically valid, meaning requests could be accepted when the assigned identity had sufficient permission.
A compromised web application holding broad access can therefore enable additional cloud operations, depending on how its credentials are protected and scoped.
Separating application responsibilities and restricting the actions available to each cloud identity can limit such exposure.
The investigation does not establish a single named threat actor, nor does it show that every observed operation was AI-generated. The security significance lies in the combination of established intrusion techniques and automation capable of coordinating activity rapidly.
Application and cloud evidence must be correlated
Arctic Wolf recommends connecting suspicious web server activity with unusual authenticated cloud requests, including calls originating from unfamiliar infrastructure or using several identities within a short period.
Successful requests to retrieve secrets or manipulate stored objects deserve examination even when surrounding requests were rejected.
Where a web application has been compromised, investigators may need to review connected cloud identities, revoke active sessions, rotate exposed credentials, and assess whether any cloud resources were accessed through those identities.
The research was published through Arctic Wolf Labs and discussed in independent reporting on the observed intrusions.
The identified activity shows how unauthorised use of legitimate cloud credentials can cross the boundary between a compromised application and production resources. The precise initial access routes and level of autonomous agent participation remain unresolved.
