AI Pentesting Platform AntiFox Linked to AWS Production Secret Access in Cyberattacks
Cybersecurity researchers have identified a series of cyberattacks where an AI-driven penetration testing platform named AntiFox was used to compromise Amazon Web Services (AWS) environments and steal production secrets. According to a report by Arctic Wolf Labs, these intrusions involved leveraging AntiFox to access AWS credentials and move laterally within compromised systems. The attacks typically began with web exploitation and web shell deployment, facilitating configuration discovery, credential validation, cloud-service enumeration, and secret access. In some instances, the activity progressed to successful `GetSecretValue` requests against production secrets. AntiFox, available on GitHub, is described as an autonomous penetration testing platform built on the ARTEX framework. The platform automates various stages of an intrusion, from reconnaissance to exploitation and report delivery, making sophisticated attack techniques more accessible to threat actors. The initial access points varied, with so...
