# Researchers link AntiFox infrastructure to AWS secret theft

_Published Wednesday, November 11, 2026 at 10:58 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Researchers link AntiFox infrastructure to AWS secret theft — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/09/robot-hacker.jpg)

Arctic Wolf researchers have linked Alibaba Cloud infrastructure hosting AntiFox, an open-source AI penetration-testing platform, to malicious activity against web services and AWS environments, BleepingComputer reports. Observed actions included webshell deployment, credential validation and production-secret theft.

In one intrusion, attackers used multiple valid AWS identities to make hundreds of API requests in about 30 minutes. Most attempts were blocked, but some succeeded in obtaining production secrets. A separate incident involved reading, copying and deleting S3 objects with a valid AWS identity.

The researchers recommend correlating webshell activity with unusual AWS access and examining successful API calls within bursts of denials.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/)

---
Canonical: https://techandbusiness.org/newswire/HbeqxViP3HhvG9_XV-l6oL
Published: 2026-11-11T15:58:46.941Z
Story chronology: 2026-11-11T15:12:59.000Z
Retrieved: 2026-11-12T01:06:50.498Z
Publisher: Tech & Business (techandbusiness.org)