In November 2026, cybersecurity researchers disclosed a campaign in which AntiFox, an emerging agentic AI penetration testing platform, was used as a launchpad for real-world intrusions. Attackers abused AntiFox interfaces hosted on Alibaba Cloud infrastructure to automate credential harvesting from Amazon Web Services (AWS) environments, then pivoted laterally into compromised production networks.
This is not a theoretical risk or a controlled red-team exercise. Researchers confirmed that AntiFox-associated infrastructure was directly linked to malicious actions against live targets — including access to production AWS secrets, exfiltration of access keys, and follow-on lateral movement.
If your organization uses AWS — and especially if your SOC does not yet treat agentic AI tooling as a threat surface — this campaign should be an immediate wake-up call.
The lines between automated penetration testing and automated intrusion have blurred. Defenders need to detect the abuse of these platforms with the same urgency they apply to traditional offensive tooling like Cobalt Strike or Metasploit.
Technical Analysis
Affected Platform and Threat Model
AntiFox is marketed as an agentic penetration testing platform — an AI-driven system capable of autonomously planning and executing attack chains against target infrastructure. Unlike legacy frameworks that require human operators to chain exploits manually, AntiFox uses a large-language-model-driven agent loop to:
- Enumerate target environments
- Identify misconfigurations and exposed credentials
- Execute exploitation steps
- Escalate privileges and pivot laterally
The platform's web interfaces and APIs were hosted on Alibaba Cloud instances — a detail confirmed in the observed intrusions. This means attackers either:
- Compromised legitimate AntiFox deployments, or
- Deployed their own instances of the platform for malicious use
Attack Chain Observed
The confirmed intrusions followed this pattern:
- Initial Access: Attackers leveraged AntiFox's agent to identify and exploit exposed AWS credentials — typically through misconfigured IAM roles, leaked
.aws/credentialsfiles, or overly permissive instance metadata service (IMDS) configurations. - Credential Theft: AWS access keys and session tokens were harvested from compromised instances and used to authenticate directly to AWS APIs.
- Lateral Movement: Using valid credentials, the agentic platform mapped internal network topology, identified additional targets, and executed follow-on actions — including data staging and exfiltration.
- Infrastructure Overlap: AntiFox control panels and callback infrastructure were observed on Alibaba Cloud IP ranges, creating a network-level detection opportunity.
Key Observable Indicators
The following behaviors are consistent with AntiFox-driven intrusions and should be treated as high-fidelity detection targets:
| Indicator | Description |
|---|---|
CreateUser, CreateAccessKey via aws-cli or SDK | New IAM users created programmatically — especially outside business hours |
sts:AssumeRole with external or unusual source IPs | Role assumption from IP ranges not associated with your organization |
| Access from Alibaba Cloud IP ranges | AWS API calls originating from Alibaba Cloud AS (AS37963, AS45102) |
ssm:SendCommand or ec2:RunInstances by unauthorized principals | SSM command execution or instance creation following credential access |
| IMDSv1 usage without token requirement | Legacy metadata service accessible without session headers |
No CVE Assigned
This campaign does not currently map to a specific CVE. The threat is abuse of a legitimate platform combined with cloud misconfiguration exploitation — a technique-level threat, not a software vulnerability.
Detection & Response
This is a technical threat requiring immediate detection engineering and hunting.
SIGMA Rules
---
title: AWS Credential Theft via Agentic AI Tooling - AntiFox Campaign
id: 3a8f2b91-6c4d-4e12-9a53-7f1d0c2b8e94
status: experimental
description: Detects creation of new IAM users or access keys via AWS CLI or SDK, a behavior observed in AntiFox-driven intrusions targeting AWS environments.
references:
- https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html
- https://attack.mitre.org/techniques/T1078.004/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1078.004
logsource:
service: cloudtrail
product: aws
detection:
selection_event:
eventSource: 'iam.amazonaws.com'
eventName:
- 'CreateUser'
- 'CreateAccessKey'
- 'AttachUserPolicy'
filter_common:
userIdentity.type: 'AssumedRole'
userIdentity.principalId|contains: ':i-'
condition: selection_event and not filter_common
falsepositives:
- Legitimate IAM user provisioning by administrators
- Automated CI/CD pipeline credential rotation
level: high
---
title: AWS API Calls Originating from Alibaba Cloud IP Ranges
id: 9c1e4d77-2f8a-4b05-8c6e-3d9a1f0e2b47
status: experimental
description: Detects AWS API activity originating from Alibaba Cloud autonomous systems, a strong indicator of AntiFox platform infrastructure being used to access AWS environments.
references:
- https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html
- https://attack.mitre.org/techniques/T1078.004/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.initial_access
- attack.t1078.004
logsource:
service: cloudtrail
product: aws
detection:
selection:
sourceIPAddress|cidr:
- '47.0.0.0/8'
- '101.0.0.0/8'
- '106.0.0.0/8'
- '120.0.0.0/8'
- '139.0.0.0/8'
- '140.0.0.0/8'
- '161.0.0.0/8'
- '198.0.0.0/8'
- '203.0.0.0/8'
filter_legitimate:
eventSource:
- 'signin.amazonaws.com'
- 'console.amazonaws.com'
condition: selection and not filter_legitimate
falsepositives:
- Legitimate multi-cloud architectures with Alibaba Cloud components
- Third-party SaaS integrations hosted on Alibaba Cloud
level: critical
---
title: AWS Systems Manager Command Execution Following Credential Access
id: 7f2a5c18-4d9e-4b31-a6c7-8e0d3f9b2a56
status: experimental
description: Detects SSM SendCommand or RunInstances API calls made by IAM users or roles that were recently created or had new access keys generated — a pattern consistent with AntiFox lateral movement.
references:
- https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.lateral_movement
- attack.execution
- attack.t1059
logsource:
service: cloudtrail
product: aws
detection:
selection_ssm:
eventSource: 'ssm.amazonaws.com'
eventName: 'SendCommand'
selection_ec2:
eventSource: 'ec2.amazonaws.com'
eventName:
- 'RunInstances'
- 'StartInstances'
condition: selection_ssm or selection_ec2
falsepositives:
- Legitimate SSM automation and patch management
- Infrastructure-as-Code deployments
level: medium
KQL — Microsoft Sentinel
Use this query to hunt for AWS credential creation events and API activity from Alibaba Cloud IP ranges. Ingest CloudTrail logs into Sentinel via the AWS S3 connector or a CEF/Syslog pipeline.
// Hunt 1: New IAM user or access key creation outside normal provisioning patterns
let TimeWindow = 7d;
let SuspiciousIPRanges = dynamic(['47.', '101.', '106.', '120.', '139.', '140.', '161.', '198.', '203.']);
AWSCloudTrail
| where TimeGenerated > ago(TimeWindow)
| where EventSource == 'iam.amazonaws.com'
| where EventName in ('CreateUser', 'CreateAccessKey', 'AttachUserPolicy')
| where UserIdentityType != 'AssumedRole'
| project TimeGenerated, EventName, UserIdentityUserName, SourceIpAddress, UserAgent, RecipientAccountId
| sort by TimeGenerated desc;
// Hunt 2: AWS API calls from Alibaba Cloud IP ranges
AWSCloudTrail
| where TimeGenerated > ago(TimeWindow)
| where SourceIpAddress startswith '47.'
or SourceIpAddress startswith '101.'
or SourceIpAddress startswith '106.'
or SourceIpAddress startswith '120.'
or SourceIpAddress startswith '139.'
or SourceIpAddress startswith '140.'
or SourceIpAddress startswith '161.'
or SourceIpAddress startswith '198.'
or SourceIpAddress startswith '203.'
| where EventSource != 'signin.amazonaws.com'
| project TimeGenerated, EventName, EventSource, SourceIpAddress, UserIdentityUserName, RecipientAccountId, UserAgent
| sort by TimeGenerated desc;
// Hunt 3: SSM SendCommand or EC2 RunInstances from non-standard principals
AWSCloudTrail
| where TimeGenerated > ago(TimeWindow)
| where (EventSource == 'ssm.amazonaws.com' and EventName == 'SendCommand')
or (EventSource == 'ec2.amazonaws.com' and EventName in ('RunInstances', 'StartInstances'))
| extend PrincipalType = tostring(parse_json(UserIdentity).type)
| where PrincipalType in ('IAMUser', 'AssumedRole')
| project TimeGenerated, EventName, EventSource, UserIdentityUserName, PrincipalType, SourceIpAddress, RecipientAccountId
| sort by TimeGenerated desc;
Velociraptor VQL
Use this VQL artifact to hunt for AWS credential files and command-line artifacts on potentially compromised Linux or Windows endpoints. This is critical for identifying whether AntiFox or similar tooling harvested credentials from your instances.
-- Hunt for AWS credential files and suspicious CLI activity on endpoints
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/.aws/credentials', 'C:/Users/*/.aws/config', '/home/*/.aws/credentials', '/home/*/.aws/config', '/root/.aws/credentials', '/root/.aws/config'])
WHERE Size > 0
ORDER BY Mtime DESC
-- Hunt for processes accessing AWS metadata service or executing AWS CLI commands
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'aws '
OR CommandLine =~ 'aws-cli'
OR CommandLine =~ '169.254.169.254'
OR CommandLine =~ 'metadata'
OR CommandLine =~ 'credentials'
OR Exe =~ 'aws'
Remediation
Immediate Actions (Next 24–72 Hours)
-
Audit AWS IAM for unauthorized users and access keys
- Review all IAM users, roles, and access keys created in the last 30 days.
- Disable any credentials not explicitly tied to a known provisioning workflow.
- Rotate any keys that may have been exposed or accessed from external IP ranges.
-
Enable and enforce IMDSv2 on all EC2 instances
- IMDSv1 allows unauthenticated retrieval of instance credentials.
- Enforce IMDSv2 at the account level using Service Control Policies (SCPs) or AWS Config rules.
Bash / Shell
AWS CLI: Enforce IMDSv2 on an instance
aws ec2 modify-instance-metadata-options
--instance-id i-0123456789abcdef0
--http-tokens required
--http-endpoint enabled
3. **Block or alert on AWS API calls from Alibaba Cloud IP ranges**
- Add explicit deny statements in SCPs for known Alibaba Cloud ASNs if your organization has no legitimate business with that provider.
- Alternatively, create CloudWatch alarms or Sentinel analytics rules for any API activity from these ranges.
4. **Review CloudTrail for anomalous `AssumeRole` and `GetSessionToken` calls**
- Look for role assumption from IP addresses outside your corporate network or VPN ranges.
- Pay special attention to `ExternalId` mismatches or missing MFA conditions.
5. **Isolate and forensically image any instances with suspicious credential access**
- If you find evidence of AntiFox tooling or AWS CLI activity from unknown processes, isolate the instance immediately.
- Capture memory and disk images before remediation.
### Medium-Term Hardening (Next 1–4 Weeks)
6. **Implement least-privilege IAM policies**
- Remove `iam:CreateUser`, `iam:CreateAccessKey`, and `iam:AttachUserPolicy` from roles that do not explicitly require them.
- Use permission boundaries to limit what newly created users can do.
7. **Deploy AWS GuardDuty and enable all threat intelligence feeds**
- GuardDuty detects `UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration` and similar findings.
- Ensure findings are routed to your SIEM and SOC.
8. **Monitor for agentic AI platform abuse**
- Treat AntiFox, and similar platforms (e.g., AutoPentest, DeepExploit derivatives), as you would Cobalt Strike: monitor for their network signatures, process artifacts, and API call patterns.
- If your red team uses these tools, establish strict attribution and logging requirements.
9. **Conduct a cloud security posture review**
- Use AWS Config, Security Hub, or a CSPM tool to identify publicly exposed resources, overly permissive security groups, and unencrypted storage.
### Vendor and Official References
- **The Hacker News — AntiFox Campaign Disclosure**: [https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html](https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html)
- **AWS IAM Best Practices**: [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
- **AWS IMDSv2 Documentation**: [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html)
- **MITRE ATT&CK — Cloud Accounts (T1078.004)**: [https://attack.mitre.org/techniques/T1078/004/](https://attack.mitre.org/techniques/T1078/004/)
---
## Related Resources
[Security Arsenal Penetration Testing Services](https://securityarsenal.com/services/managed-soc)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[vulnerability-management Intel Hub](https://securityarsenal.com/intel/managed-soc)
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.