{"data":{"id":"cce407ab-7cb4-43ac-b44e-a709674c6356","title":"Hackers use AntiFox AI agents in AWS credential-theft attacks","summary":"Attackers hosted self-managed instances of AntiFox, an open-source agentic penetration testing platform forked from ARTEX 0.1.1, on Alibaba Cloud to exploit web services and AWS environments. Arctic Wolf observed the infrastructure using valid AWS IAM users and assumed EC2 roles to make authenticated API calls, harvesting production secrets and reading, copying, and deleting S3 objects in some intrusions.","solution":"Arctic Wolf recommends correlating IIS webshell activity with unusual AWS access, reviewing successful API calls within bursts of denials, revoking affected AWS sessions and keys, and rotating credentials exposed through application files.","labels":["security","industry"],"sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/","publishedAt":"2026-11-11T15:12:59.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AntiFox","ARTEX AI","Alibaba Cloud","AWS","Arctic Wolf"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-11T15:12:59.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}