Researchers report that an agentic penetration testing platform called AntiFox has been used in a campaign involving theft of Amazon Web Services (AWS) credentials and subsequent access to compromised environments. The reporting links AntiFox interfaces hosted on Alibaba Cloud to observed intrusions in which attackers obtain credentials and then pivot within victim systems.
Across outlets, the core details are consistent: AntiFox is described as an emerging, open-source AI/agentic pentesting platform that attackers are running on self-managed infrastructure. Both sources emphasize the hosting arrangement through Alibaba Cloud and the targeting of AWS web services and environments. While one outlet frames the issue as a broader association between AntiFox-linked infrastructure and confirmed malicious actions, the other foregrounds the method—credential theft using AntiFox AI agents in AWS-focused attacks—while describing the infrastructure setup used by attackers.
Taken together, the articles present the same allegation: AntiFox is being repurposed from pentesting tooling into an offensive credential-theft workflow against AWS systems.
