[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6y3Q251LuMvzO12wGWRX7D0qeZPixsY3qIKANXt6-BU":3},{"article":4,"iocs":53,"watch_terms":56,"solutions":57,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"61d26e20-d1a9-4b98-876c-10e8177e1300","AI Pentest Tool AntiFox Abused To Steal AWS Credentials","ai-pentest-tool-antifox-abused-to-steal-aws-credentials-236b27","Arctic Wolf saw attackers use the AntiFox pentest platform to hit IIS servers and AWS accounts. Arctic Wolf Labs has published research on attackers using AntiFox, an open-source, Chinese-language agentic penetration testing platform. These frameworks chain attack steps together with little human effort. In several intrusions, Alibaba Cloud systems hosting AntiFox interfaces were tied to […]","Attackers are leveraging the open-source, Chinese-language penetration testing platform AntiFox to target IIS servers and AWS accounts. Arctic Wolf Labs observed intrusions where AntiFox, hosted on Alibaba Cloud, was used to gain access to web services and cloud environments. The tool automates attack steps, enabling attackers to steal database credentials from IIS configurations and enumerate AWS resources, including IAM, EC2, and S3, to access secrets and data.","Attackers abuse AntiFox AI pentest tool to steal AWS credentials and target IIS servers.","https:\u002F\u002Fsecurityaffairs.com\u002F202880\u002Fhacking\u002Fai-pentest-tool-antifox-abused-to-steal-aws-credentials.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-23.png","2026-11-11T21:31:32+00:00","2026-11-11T23:00:38.123194+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"AntiFox","product",{"name":21,"type":22},"IIS","technology",{"name":24,"type":22},"AWS",{"name":26,"type":27},"Alibaba Cloud","vendor",{"name":29,"type":27},"Arctic Wolf","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":34,"value":18,"context":55},"AI pentest tool abused by attackers",[26,29,18],{"controls":58,"vendors":140},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":89,"name":90,"problem":91,"products":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,127,135],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":123,"product_name":124,"url":125,"description":126},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":136,"product_name":137,"url":138,"description":139},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[141,146],{"slug":142,"name":29,"logo_path":143,"roles":144},"arctic-wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[145],"reported_by",{"slug":65,"name":66,"logo_path":67,"roles":147},[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"antifox-tool-exploits-weak-iis-configs-to-steal-aws-credentials","AntiFox Tool Exploits Weak IIS Configs to Steal AWS Credentials","Attackers used the open-source AI-assisted pentesting tool AntiFox to automate the extraction of database credentials embedded in IIS server configurations, then pivoted to enumerate and access AWS resources including IAM, EC2, and S3. The root problem is twofold: sensitive credentials were stored in plaintext or easily accessible IIS configuration files, and AWS IAM permissions were overly broad, allowing enumeration and data access once credentials were compromised. This incident illustrates how automated tooling dramatically lowers the skill bar for attackers, turning a misconfigured web server into a full cloud account takeover. Organizations that treat cloud credential hygiene and least-privilege IAM as optional housekeeping tasks face existential risk to their cloud-hosted data and infrastructure.",[154,155,156,157,158],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 PR.AA-05: Access permissions and authorizations","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":160,"CIS Control 3: Data Protection":161,"CIS Control 6: Access Control Management":162,"NIST SP 800-53 IA-5: Authenticator Management":163,"NIST CSF 2.0 PR.AA-05: Access permissions and authorizations":164},"The incident stems from failures in access control and asset management—specifically unprotected credentials in server configs and unconstrained cloud IAM roles—which Article 21(2)(i) explicitly requires organizations to govern.","Storing credentials in IIS configuration files violates data protection hygiene; CIS Control 3 requires that sensitive data, including credentials, be identified and protected from unauthorized access.","Overly permissive IAM roles allowed attackers to enumerate and access AWS resources after credential theft; CIS Control 6 requires least-privilege access to be enforced for all accounts and cloud identities.","Credentials embedded in IIS config files represent poor authenticator management; IA-5 requires organizations to protect authenticators from unauthorized disclosure and enforce secure storage practices.","Broad IAM permissions enabled post-compromise enumeration of cloud resources; this category requires that access permissions are managed with least privilege to limit what an attacker can do with stolen credentials."]