Hackers weaponize AI pentesting tool AntiFox to raid AWS secrets

Security researchers at Arctic Wolf have caught hackers using a Chinese-made, open-source AI penetration testing platform called AntiFox to launch attacks against web services and Amazon Web Services environments. The attackers deploy self-managed AntiFox instances on Alibaba Cloud to automate tasks like finding vulnerabilities, planting backdoor webshells, and stealing credentials. In several documented intrusions, they used valid AWS identities (both IAM users and EC2 roles) to flood AWS APIs with hundreds of requests, trying to harvest secrets like database connection strings and S3 object data. While many attempts were blocked, some succeeded, giving attackers access to production secrets and the ability to read, copy, or delete cloud storage. The threat shows how legitimate offensive security tools can be repurposed for real attacks, and defenders must watch for bursts of API denials paired with webshell activity on their IIS servers.