AntiFox AI pentesting tool linked to AWS credential theft

An emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services credentials and move laterally inside compromised cloud environments, according to research disclosed on 11 November 2026 and reported by The Hacker News.

The report says that in several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against victim environments. The stolen material included AWS credentials, which the attackers then used to pivot further into the environments they had breached. The number of affected organisations was not given in the disclosure.

AntiFox is described as an agentic penetration testing platform, meaning software that uses an AI agent to carry out offensive security testing tasks with a degree of autonomy rather than requiring an operator to run each step by hand. That category of tool is built to find and exploit weaknesses, which is precisely what makes misuse difficult to distinguish from legitimate testing once credentials are in play.

The case fits a pattern that has become familiar to defenders: the problem is not a flaw in the agent's code but the use of the agent's intended capabilities against targets that never authorised the testing. Logs that show an automated tool enumerating cloud resources and retrieving secrets look much the same whether the activity was contracted or not. Where production secrets are involved, the consequences are immediate, because AWS credentials often grant access to data stores, compute and further credentials in turn.

The researchers linked the activity to infrastructure on Alibaba Cloud that hosted AntiFox interfaces. The disclosure as reported does not attribute the intrusions to a named group, does not identify the victims, and does not state when the intrusions began. It also does not say whether AntiFox's operators were aware of, or involved in, the activity carried out through those interfaces. No response from AntiFox was included in the report.

For organisations running workloads in AWS, the practical reading is narrow but clear. Credentials recovered during an intrusion remain useful to an attacker until they are rotated, and agentic tooling shortens the time between an initial foothold and the point at which secrets are collected and reused elsewhere. Defenders looking for indicators may wish to review outbound connections and API activity involving cloud-hosted testing platforms that their security teams did not commission.

The status of the case is reported rather than confirmed by the vendor. Further technical detail, including indicators of compromise, had not been published at the time of the disclosure.