AntiFox AI Agents Weaponized for AWS Credential Theft: Detection and Hardening Guide

Security researchers have identified an active campaign in which threat actors are deploying self-managed instances of AntiFox — an open-source, agentic AI penetration testing platform — on Alibaba Cloud infrastructure to attack internet-facing web services and, ultimately, Amazon Web Services (AWS) environments. The end goal of these operations is credential theft: harvesting AWS access keys, session tokens, and instance metadata credentials that give the attackers a foothold inside victim cloud tenants.

This is a meaningful escalation in a trend we've been tracking all year: adversaries industrializing offensive AI tooling. Where a human operator once had to manually chain reconnaissance, vulnerability probing, and credential extraction, an agentic platform can now execute that loop autonomously, at scale, around the clock. When that automation is pointed at your web tier and your cloud control plane, your detection window shrinks from days to minutes.

If your organization runs workloads on AWS — particularly EC2 instances serving web traffic, containers with overly permissive IAM roles, or applications vulnerable to SSRF — you are in the blast radius of this campaign. This post breaks down how the attacks work and gives you field-tested detection content you can deploy today.

What Is AntiFox and Why Does It Matter?

AntiFox is an open-source agentic penetration testing platform. Unlike traditional scanners that follow a static playbook, agentic frameworks use large language models to plan, execute, and adapt multi-stage attack chains: enumerate a target, identify a weakness, select an exploit path, execute it, evaluate the result, and pivot — with minimal human involvement.

None of that is inherently malicious. The problem, as with Metasploit, Cobalt Strike, and every dual-use tool before it, is that the same autonomy that makes AntiFox attractive to red teams makes it devastating in the hands of criminals. Per the reported campaign:

• Operators are hosting AntiFox on Alibaba Cloud, standing up self-managed instances that serve as attack origination points. Cloud hosting gives them disposable, high-bandwidth infrastructure that blends into legitimate cloud traffic.
• Targets are internet-facing web services and AWS environments. The attacks are oriented toward applications and configurations that can be leveraged into AWS credential exposure — the classic SSRF-to-metadata chain, exposed environment files, leaked .aws directories, and overly permissive instance roles.
• The objective is credential theft, not defacement or noise. Stolen AWS keys are monetized through cryptomining, data extortion, and resale of initial access.

The strategic concern for defenders: agentic tooling compresses the attack lifecycle. Reconnaissance, exploitation, and credential access can occur in a single automated session. Post-compromise detection (the "we'll catch them at exfiltration" model) is no longer sufficient — you must detect the credential access itself.

Technical Analysis

Affected Platforms and Attack Surface

There is no single vulnerable product here — this is a technique-level campaign, not a CVE. No CVE identifier has been published for this activity, and none should be invented. The affected surface is any environment with these characteristics:

• EC2 instances with IMDSv1 enabled. The Instance Metadata Service at 169.254.169.254 will hand temporary IAM credentials to any process — or any SSRF-vulnerable application — that asks. IMDSv1 remains the single largest amplifier of web-tier compromise into cloud compromise.
• Web applications vulnerable to SSRF, file inclusion, or path traversal, which agentic tooling is exceptionally good at discovering and weaponizing at machine speed.
• Long-term IAM access keys (the AKIA... pattern) embedded in code repositories, environment files (.env), CI/CD artifacts, or web-accessible paths.
• Overly permissive instance profiles and task roles, where a single set of stolen credentials yields broad s3:*, iam:*, or sts:AssumeRole capability.

Attack Chain (Defender's View)

1. Staging: The actor provisions AntiFox on Alibaba Cloud compute. Attack traffic originates from Alibaba Cloud IP space, which defeats naïve blocklists built around "known-bad" VPS providers.
2. Automated reconnaissance: The agent enumerates target web services — endpoints, parameters, technologies — and probes for injection, SSRF, misconfiguration, and exposed files at high velocity.
3. Exploitation: A weakness (classically SSRF) is weaponized to reach the instance metadata endpoint, or exposed files yield credentials directly.
4. Credential access: The agent retrieves IAM temporary credentials from http://169.254.169.254/latest/meta-data/iam/security-credentials/, or harvests static keys from the host.
5. Validation and pivot: Stolen credentials are validated (e.g., sts:GetCallerIdentity) and used against the victim's AWS control plane for enumeration, persistence, and data access.

Exploitation Status

This is confirmed active, in-the-wild exploitation — not a theoretical capability demonstration. Real targeting of web services and AWS tenants has been observed, with Alibaba Cloud serving as the hosting platform for the offensive instances. Treat internet-facing AWS workloads as actively targeted.

Detection & Response

The most reliable detection points are host-level behaviors that are anomalous regardless of which AI tool generated them: web servers and unusual processes reaching the metadata endpoint, processes touching AWS credential files, and rapid credential validation from foreign ASN space. The rules below focus on those high-fidelity signals.

Sigma Rules

---
title: Process Access to Cloud Instance Metadata Service
id: 8f2a1b34-6c9d-4e5a-b7f1-2a3c4d5e6f70
status: experimental
description: Detects command-line tools and scripting engines requesting the cloud instance metadata endpoint (169.254.169.254), a hallmark of SSRF verification and credential theft from EC2.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
  - https://attack.mitre.org/techniques/T1552/005/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '169.254.169.254'
      - 'instance-metadata'
  filter_known_agents:
    Image|endswith:
      - '\AmazonSSMAgent.exe'
      - '\Ec2Config.exe'
  condition: selection and not filter_known_agents
falsepositives:
  - Legitimate cloud-init, SSM, or inventory agents querying metadata
level: high
---
title: Curl or Wget Request to Instance Metadata Service (Linux)
id: 3b7c9d21-4f8a-4e6b-a1c2-9d8e7f6a5b40
status: experimental
description: Detects curl, wget, python, or perl on Linux requesting the EC2 metadata credentials path — the core action in SSRF-to-credential-theft chains such as the AntiFox campaign.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
  - https://attack.mitre.org/techniques/T1552/005/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
  selection_target:
    CommandLine|contains:
      - '169.254.169.254'
      - '/latest/meta-data/iam/security-credentials'
  condition: all of selection_*
falsepositives:
  - Instance bootstrap scripts and legitimate automation reading metadata at provisioning time
level: high
---
title: AWS Credential File Access by Non-Standard Process
id: 5e1d2c93-7a4b-4f6c-83d0-1e2f3a4b5c6d
status: experimental
description: Detects processes other than the AWS CLI or SDK tooling reading local AWS credential or config files, indicating credential harvesting from developer workstations, build agents, or compromised servers.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.aws\credentials'
      - '\.aws\config'
  filter_legit:
    Image|endswith:
      - '\aws.exe'
      - '\aws_completer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Backup agents and DLP scanners reading user profile directories
level: high

KQL (Microsoft Sentinel / Defender)

The following hunt looks across endpoint process telemetry and network events for metadata-service access and AWS credential file interaction — the two highest-fidelity behaviors in this campaign. It works whether your EC2 fleet reports via Defender for Endpoint, Sysmon, or Syslog/CEF ingestion.

let MetadataIP = "169.254.169.254";
let CredPaths = dynamic(["/.aws/credentials", "\\.aws\\credentials", "/.aws/config", ".env"]);
let ProcEvents = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any (CredPaths)
   or ProcessCommandLine contains MetadataIP
   or (FileName in~ ("curl", "curl.exe", "wget", "python", "python3", "perl", "powershell.exe")
       and ProcessCommandLine contains "security-credentials")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, ReportId;
let NetEvents = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteIP == MetadataIP
| where InitiatingProcessFileName !in~ ("amazon-ssm-agent", "ssm-agent-worker", "systemd", "cloud-init")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ReportId;
union ProcEvents, NetEvents
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Signals = count(), Samples = make_set(ProcessCommandLine, 3) by DeviceName, AccountName
| order by Signals desc;

Tuning guidance: expect bootstrap-time noise on newly provisioned instances. Baseline per AMI/Launch Template and alert on web server processes (nginx, apache, httpd, java, node, php-fpm) or their children touching the metadata IP — that pattern is almost never legitimate and is the signature of SSRF-driven credential theft.

Velociraptor VQL

For live-response hunting across your Linux and Windows fleet, this artifact surfaces processes interacting with the metadata endpoint or AWS credential material:

-- Hunt for processes interacting with cloud metadata or AWS credential files
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '169\\.254\\.169\\.254|security-credentials|\\.aws[/\\\\]credentials|AKIA[0-9A-Z]{16}'
  AND NOT Name =~ '(?i)ssm-agent|amazon|cloud-init'

Pair it with a connection check to catch in-flight metadata theft:

-- Identify live connections to the instance metadata endpoint
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Raddr.IP =~ '169\\.254\\.169\\.254'
  AND NOT Name =~ '(?i)ssm-agent|cloud-init'

Remediation / Verification Script

Run the following against your AWS estate to enforce IMDSv2 (which breaks the classic SSRF-to-credentials chain) and to sweep common web roots for exposed credential material:

#!/bin/bash
# AntiFox campaign hardening: enforce IMDSv2 and sweep for exposed AWS credentials
set -euo pipefail

REGION="${AWS_REGION:-us-east-1}"

echo "=== [1/3] Enforcing IMDSv2 on all EC2 instances in ${REGION} ==="
for id in $(aws ec2 describe-instances --region "$REGION" \
  --query "Reservations[].Instances[?MetadataOptions.HttpTokens=='optional'].InstanceId" \
  --output text); do
  echo "  -> Requiring IMDSv2 on $id"
  aws ec2 modify-instance-metadata-options --region "$REGION" \
    --instance-id "$id" --http-tokens required --http-endpoint enabled
done

echo "=== [2/3] Sweeping web roots for exposed AWS access keys and credential files ==="
sudo grep -rEl 'AKIA[0-9A-Z]{16}|aws_secret_access_key' \
  /var/www /srv/www /opt /home 2>/dev/null | tee /tmp/exposed_aws_creds.txt || echo "  None found."

echo "=== [3/3] Auditing IAM credential report for unused/stale access keys ==="
aws iam generate-credential-report >/dev/null 2>&1 || true
aws iam get-credential-report --query 'Content' --output text | \
  base64 -d | awk -F',' 'NR==1 || $9=="true" || $10=="true" {print $1, $9, $10}' | column -t

echo "Done. Review /tmp/exposed_aws_creds.txt and rotate any keys found immediately."

Remediation & Hardening

Because this campaign exploits configuration weaknesses rather than a patchable CVE, remediation is architectural. Prioritize in this order:

1. Enforce IMDSv2 everywhere. IMDSv2's session-oriented, PUT-based token requirement defeats the overwhelming majority of SSRF-driven metadata theft. Set HttpTokens=required on every instance and enforce it in Launch Templates and via SCP.
2. Eliminate long-term access keys from hosts and code. Move workloads to IAM roles/instance profiles; sweep repositories, .env files, container images, and CI artifacts for AKIA keys; rotate anything found and audit CloudTrail for use after the estimated exposure window.
3. Shrink credential blast radius. Scope instance roles and task roles to least privilege. A stolen role with s3:GetObject on one bucket is an incident; a stolen role with AdministratorAccess is a breach notification.
4. Turn on cloud-native detection. Enable GuardDuty (it has dedicated findings for credentials used from unusual ASNs and known-malicious infrastructure), CloudTrail in all regions with management and data events for sensitive stores, and alert on GetCallerIdentity/AssumeRole anomalies and console logins originating from Alibaba Cloud IP space where your business has no presence there.
5. Harden the web tier against agentic scanning. These agents generate request volumes and probing patterns far denser than human testers: enforce WAF rate limiting, block requests to internal/link-local destinations at the application and egress firewall level, and alert on response-body patterns containing IAM credential JSON.
6. Egress control. Deny outbound access to 169.254.169.254 from application containers that don't need it, and consider egress filtering on cloud-provider address space that is irrelevant to your operations.
7. Threat-hunt retroactively. Query the last 30–90 days for the behaviors in the detection section above. Agentic campaigns are fast; if you were targeted, the credential access already happened.

Source reporting: BleepingComputer — Hackers use AntiFox AI agents in AWS credential-theft attacks

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub