Arctic Wolf, a security firm, said attackers ran AntiFox on Alibaba Cloud servers to attack web services and Amazon Web Services (AWS) accounts. AntiFox is an open source, Chinese-language tool that uses AI agents to automate break-in testing. On one Windows web server, the site's own process wrote a web shell, a hidden page for running commands. Commands then read config files and found database connection strings. In one AWS case, a single source cycled through several identities and sent hundreds of requests in about 30 minutes. Most were denied, but some worked, including a request for a production secret.
Arctic Wolf did not find the flaw that gave attackers control of the web server. The AWS-only cases began with a valid credential obtained through unknown means. The report does not say the AWS credentials came from the web server. It names no victims. BleepingComputer reported on 11 November that AntiFox is still on GitHub. Its publishers ban live use but describe no controls that enforce the ban.
Arctic Wolf said such tools make attack methods faster and more consistent. Here, the denials did not stop the attack, because the few successful calls sat inside the same burst. So a mostly denied burst is not proof of safety. Arctic Wolf advises narrow permissions, so application identities cannot list resources across the account. It also notes that if a hacked web app stored AWS credentials, misuse could start soon after config discovery.