Cybersecurity researchers have uncovered a campaign in which an emerging AI-driven penetration testing platform called AntiFox has been weaponized to steal Amazon Web Services credentials and move laterally into breached cloud environments. Arctic Wolf Labs disclosed the findings in a report shared with The Hacker News. The activity demonstrates how autonomous hacking tools are being turned against real-world targets, chaining together web exploitation, credential theft, and cloud service enumeration with minimal human oversight.

In the intrusions analyzed by Arctic Wolf, attackers began by compromising internet-facing Internet Information Services (IIS) applications, then deployed ASPX web shells through the IIS worker process to run operating system commands. These commands hunted for web.config files and configuration backups, extracted database connection strings from application settings, and enumerated debug and error-log directories. In separate attacks, threat actors started with valid AWS credentials obtained through unknown means, then abused legitimate IAM identities to validate those credentials and scan dozens of services including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock. While most authenticated API requests returned "AccessDenied" errors, some discovery and secret-access operations succeeded—in at least one instance, attackers progressed beyond Secrets Manager enumeration to a successful GetSecretValue request against a production secret. As of November 4, 2026, data from Censys shows 1,465 hosts running an exposed ARTEX console worldwide, concentrated in the U.S., Hong Kong, China, Japan, Singapore, and South Korea. AntiFox, available on GitHub with 474 stars and 251 forks, describes itself as an autonomous penetration testing platform built on ARTEX that runs a multi-agent system over a dual-graph core—conducting reconnaissance, attack-surface discovery, exploitation, finding capture, and report delivery with full observability.

Arctic Wolf writes that "agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks." The company notes that on a compromised IIS server, commands run through w3wp.exe identified the execution context with whoami, enumerated the application directory, checked permissions with icacls, and tested the ability to write files into the web root. According to Arctic Wolf, the creation of an ASPX web shell by w3wp.exe, followed by command execution through the same IIS worker process, suggests compromise through the affected web application—though the precise vulnerability used to achieve code execution remains unknown. Check Point Research separately identified 2,557 systems hosting ARTEX, including 10 misconfigured instances exposing their full databases, and observed that "in many observed cases, ARTEX required remarkably little interaction from its operators once an objective had been established."

The integration of AI into hacking workflows allows adversaries to automate various stages of an intrusion with minimal human intervention, according to the report. Threat actors are increasingly weaponizing AI-powered penetration testing tools like ARTEX to conduct broad-scale attacks across the world, enabling them to adapt established tradecraft and deploy it at machine speed—making it possible to progress from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes. The vast majority of attacks observed by Check Point are designed to siphon cryptocurrency, steal Apple code-signing certificates, compromise gaming accounts, and conduct denial-of-service attacks against gambling websites. In the campaign targeting Apple code-signing certificates, ARTEX agents searched compromised systems for certificate databases, then validated the stolen certificates by checking passwords, private keys, Apple revocation status, expiration dates, and associated provisioning profiles—ultimately harvesting more than 300 certificates and their passwords, of which three passed full validation and could be used to sign arbitrary iOS applications. Tools like AntiFox and ARTEX are part of a broader set of about 45 open-source agentic attack frameworks engineered to connect to a large language model and act on outputs autonomously, spanning five categories: network kill chain, web-app and API, C2-integrated, harnesses, and research prototypes.

The biggest change brought by agentic hacking to the cyber threat landscape is scale and speed, Check Point cautions, as a cybercriminal with limited technical skills can task AI agents with investigating a number of targets in parallel and exploiting them using known and zero-day vulnerabilities with less manual effort. CERT-EU warns in an alert that "ARTEX can test large numbers of low-complexity misconfigurations, including those a human tester would notice but not have time to check, and it can work through long attack chains without the fatigue that limits manual testing." The same is true of complex payload crafting—exploitation paths that need carefully tailored payloads often take more effort than the severity of the finding justifies, so a manual assessment may leave them untested, the agency notes. GitGuardian observes that agentic AI pentesting tools hand their agent a shell and web access, so the model can assemble a pipeline at runtime—a GitHub search, a scanner download, and a found key passed to the next call are all one prompt away, even though none of it ships in the repository. Organizations defending against cloud environments and internet-facing applications now face adversaries whose reconnaissance, exploitation, and post-exploitation cycles run continuously and autonomously, compressing attack timelines that once spanned days into minutes. The shift from manual hacking to agent-driven intrusion fundamentally alters the economic calculus for defenders, who must now assume that every misconfiguration will be tested and every exposed credential will be validated.