AntiFox-Linked Intrusions Read AWS Production Secrets via GetSecretValue

Arctic Wolf Labs has linked the open-source agentic penetration-testing platform AntiFox to intrusions that reached Amazon Web Services production secrets. Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and the AWS environments tied to them. The activity chained web exploitation to an ASPX web shell created through w3wp.exe, the IIS worker process, then moved to configuration discovery, credential checks, cloud enumeration, secret access, and storage operations. AntiFox, on GitHub, has 474 stars and 251 forks and advertises a planner-worker multi-agent system that runs recon through exploitation to a client-ready report.

The evidence trail is a command sequence, not a named CVE. On the compromised IIS server, commands through w3wp.exe ran whoami, enumerated the application directory, checked permissions with icacls, and tested writes into the web root. PowerShell located web.config files and backups, read application settings and database connection strings, and copied configuration and logs into a web-accessible upload directory. An extracted credential was tried against an internal production database. Valid IAM identities also enumerated dozens of AWS services, including Secrets Manager, S3, KMS, and Lambda. Most calls returned AccessDenied. Some succeeded, including GetSecretValue on a production secret.

Split the claim from the proof. Arctic Wolf, an independent lab, shows AntiFox-hosting infrastructure associated with confirmed malicious actions and a post-exploitation sequence that matches the tool's advertised loop: recon, attack-surface discovery, exploitation, evidence capture. That is not proof the multi-agent graph ran unattended, and it is not a state attribution. Alibaba Cloud is a hosting choice, not a flag. No government or AWS statement in this record names the operator. The operational shift is that a public agent built to finish past discovery now sits in the same traffic as production secret reads.

Defenders should treat agentic pentest frameworks the way they already treat leaked commercial attack kits: the README is marketing until the telemetry says otherwise, then it is a signature. Watch for w3wp.exe spawning PowerShell, writing ASPX into the web root, and an IAM principal that fans out across dozens of services before GetSecretValue. If Arctic Wolf or AWS releases indicators, the test is whether they catch the agent loop, not only the shell. Procurement and cloud-security teams that bought autonomous pentest as a product now have a live case that the same delivery pipeline works without a statement of work.