According to BleepingComputer (11 November 2026), researchers at Arctic Wolf observed attackers using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration-testing platform with a Chinese-language interface that began as a fork of ARTEX 0.1.1, to target web services and AWS environments.

Arctic Wolf says: "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments."

BleepingComputer reports that the infrastructure was used for vulnerability exploitation, webshell deployment, credential validation, configuration discovery and AWS secret harvesting, using valid AWS identities including IAM users and, in some cases, assumed EC2 roles. In one case highlighted by Arctic Wolf, an ASPX webshell was deployed on an internet-exposed IIS server and used to run OS commands, read application settings and database connection strings, and copy configuration and log files to a web-accessible directory; in one intrusion the attacker cycled through multiple identities and made hundreds of AWS API requests in about 30 minutes.

Most attempts were blocked, but in some cases the attacker obtained production secrets, and in a separate incident a valid AWS identity was used to read, copy and delete S3 objects, according to the researchers as reported by BleepingComputer. Arctic Wolf recommends correlating IIS webshell activity with unusual AWS access, reviewing successful API calls within bursts of denials, revoking affected AWS sessions and keys, and rotating credentials exposed through application files. (source: BleepingComputer)