Cybersecurity researchers have revealed a new threat campaign that exploits an emerging agentic penetration testing platform known as AntiFox to steal Amazon Web Services (AWS) credentials and move laterally within compromised environments.
The investigation shows that attackers used AntiFox to gain initial access to AWS accounts, then leveraged those credentials to expand their reach into other parts of the target’s network. The platform’s ability to autonomously conduct penetration tests has made it a tool of choice for malicious actors seeking to bypass traditional security controls.
In several recent intrusions, the researchers identified Alibaba Cloud systems that hosted AntiFox interfaces as being linked to confirmed malicious activity. These systems appeared to serve as launch points for the credential‑stealing operations and subsequent lateral movement.
While the details of the specific attacks remain limited, the findings underscore the growing risk posed by sophisticated, agentic tools that can be weaponised by threat actors. The use of such platforms highlights the need for organisations to monitor not only their own infrastructure but also the cloud services that host third‑party security tools.
Security teams are advised to review their AWS access controls, enforce least‑privilege policies, and monitor for unusual activity on cloud accounts that could indicate the use of tools like AntiFox. Further analysis by the researchers is expected to shed more light on the full scope of the campaign and its impact on affected organisations.
<small>Source: The Hacker News — read the original story there.</small>
