AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

Summary

Arctic Wolf Labs reports that attackers have used AntiFox, an AI-driven autonomous penetration testing platform available on GitHub, in intrusions that stole AWS credentials and moved laterally. The activity chained web exploitation and ASPX web shell deployment through the IIS worker process (w3wp.exe) with AWS API enumeration, including Secrets Manager access, and the precise vulnerability used for code execution on the IIS server is not known.

Related items

• InfoAnthropic's IPO roadshow videoSame vendor · Simon Willison's Weblog
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSame vendor · AWS Security Bulletins
• InfoJim Cramer says Anthropic's IPO could make or break the AI trade. Here's whySame vendor · CNBC Technology
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSame vendor · AWS Security Blog
• InfoChatGPT Enterprise now available in AWS MarketplaceSame vendor · OpenAI Blog