AntiFox AI agents hijacked by hackers to carry out theft of AWS credentials

Hackers are exploiting an AI-powered penetration testing tool called AntiFox to gain unauthorized access to Amazon Web Services (AWS) environments. Arctic Wolf, a security research firm, recently disclosed the issue on GitHub, revealing that threat actors have been using AntiFox to steal AWS credentials and infiltrate cloud environments.

AntiFox is an open-source platform developed by a Chinese developer that automates the penetration testing process, making it easier for malicious actors to identify vulnerabilities in IT infrastructure.

The attackers typically begin by compromising internet-facing Microsoft Internet Information Services (IIS) web servers, installing web shells to execute remote commands, and searching for sensitive data such as database login credentials. In some cases, they attempt to access internal production databases using the stolen credentials.

In other instances, they utilize valid AWS credentials obtained from other sources to explore cloud environments, uncovering accounts, permissions, databases, storage servers, and other critical resources.

Amazon responded by stating that their services functioned as intended and advised customers to maintain strong password security. They also recommended adhering to security best practices, including least-privilege access controls, using IMDSv2 on EC2 instances, avoiding storing long-term access keys in application configurations, and activating Amazon GuardDuty.

Researchers urge organizations to monitor for suspicious web shells, rotate exposed secrets, and enforce least-privilege access controls. They should also investigate unusual AWS activity and terminate unfamiliar web shells immediately, review compromised systems, and rotate any exposed passwords, API keys, and cloud credentials. Enabling detailed logging can aid in detecting unauthorized access and data modifications.