AntiFox Targeting AWS Credentials: The Latest Wave of AI Agent Attacks

Attackers are using AntiFox, an agentic AI framework forked from ARTEX, to target AWS environments for credential theft, with Arctic Wolf researchers linking infrastructure running the framework to real intrusions, BleepingComputer reported. In one intrusion attackers generated hundreds of AWS API requests in approximately 30 minutes, and while most were denied, some succeeded, including operations that exposed production secrets; a separate incident used valid credentials to access S3 objects. The report notes only 4 of roughly 45 attack frameworks ship a secrets scanner, yet an ARTEX build with none found 8 of 9 planted credentials starting in under 13 seconds.

TL;DR - The hacking agent got a sequel in under a week : AntiFox, a fork of ARTEX, now points the same agentic playbook at AWS. Hundreds of API requests in about 30 minutes were enough to reach production secrets. - It does not even need a secrets scanner : Only 4 of roughly 45 attack frameworks ship one, yet an ARTEX build with none found 8 of 9 planted credentials, starting in under 13 seconds. - Deleting a leaked key fixes nothing : The access lives on until you revoke it. Learn the Detect, Remediate, Prevent moves that shrink what a machine-speed attacker can find. Last week, Microsoft Threat Intelligence reported https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/ attackers using ARTEX, an agentic AI framework, to find exposed credentials on GitHub and abuse them to access cloud environments. Now, less than a week later, BleepingComputer reports https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/?ref=blog.gitguardian.com attackers using another agentic framework called AntiFox to target AWS environments. AntiFox began as a fork of ARTEX, and researchers at Arctic Wolf have linked infrastructure running the framework to real intrusions involving credential theft and unauthorized cloud access. The attackers used this offensive agentic framework to compromise web applications, steal configuration data, and use any valid AWS identities it could find. In one intrusion, attackers generated hundreds of AWS API requests in approximately 30 minutes. Most requests were denied, but some succeeded, including operations that exposed production secrets. The attackers also used valid credentials to access S3 objects in a separate incident. A new variant of the same AI framework, this time leveraging a different cloud provider. This is likely the tip of an iceberg. We are likely going to see more evidence of a wider shift in how cyberattacks are being conducted. The good news is that the security industry has been preparing for this evolution for years, and there are some mitigation paths anyone can jump on. Unfortunately, the speed and accessibility of these tools are changing faster than many organizations have been able to evolve. We are at a crossroads, and companies need to rethink how access rights and credentials, which are core to any of these attacks, are handled across the whole org. From Metasploit to ARTEX, offensive security is evolving Attackers have always used legitimate security tools for malicious purposes. Legitimate pen testing tools like Burp Suite, Metasploit https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware?ref=blog.gitguardian.com , and Netcat are essential for penetration testers and security researchers. They help professionals understand how systems communicate, discover vulnerabilities, and test whether security controls work as intended. When used against systems you own, these are powerful learning tools, and the communities and companies that maintain them are doing good work. Those same capabilities are useful to attackers. However, historically, using these tools effectively required deep technical knowledge. Netcat provides powerful networking capabilities, but operators need to understand protocols, connections, and what to do with the resulting access. Metasploit provides extensive exploitation capabilities, but operators still need to understand target environments, identify applicable exploits, and navigate the results. Agentic AI frameworks lower that barrier to entry Now, an attacker can give an agent a goal in plain language. The agent can investigate the environment, select tools, execute commands, interpret the results, and decide what to try next. Anyone with access to AntiFox or ARTEX can just verbally say into the dictation, "find exposed credentials, determine what they access, and identify valuable resources." That incantation initiates a series of technical actions that previously required considerably more hands-on expertise. The tools are also becoming better at recovering from failed attempts. An agent can encounter an error, interpret the response, modify its next command, and continue investigating. Security professionals benefit from the same capabilities during authorized assessments. The underlying technology has legitimate uses, just as traditional penetration-testing tools do. The growing concern is how cheaply and easily these capabilities can now be applied to real targets. ARTEX is the tip of an iceberg The emergence of AntiFox follows a larger trend that GitGuardian's security research team has already been investigating. GitGuardian researchers published an analysis of approximately 45 agentic attack frameworks https://blog.gitguardian.com/ai-pentesting-tools-beyond-artex/ , examining how they operate, integrate, and how they can be used to discover exposed secrets. Some come with dedicated secrets scanners. Others rely on general-purpose tools and let the language model figure out how to accomplish the objective. Researchers found that only four of the examined frameworks shipped with a working secrets scanner integrated into the agent. None shipped a complete built-in GitHub secret-hunting pipeline. That does very little to limit what they can accomplish, however. Most of these frameworks give their agents access to a shell and the internet. They can search GitHub, download utilities, inspect files, and use the information they discover to plan subsequent actions. GitGuardian researcher Guillaume Valadon recently published a controlled ARTEX experiment https://blog.gitguardian.com/an-artex-build-ships-no-secret-scanner-in-our-lab-it-found-the-secrets-anyway/ that demonstrated this capability. The tested ARTEX build had no dedicated secrets scanner. It still found eight of nine planted credentials using ordinary commands such as git and grep. The agent began searching for secrets within 6 to 13 seconds, even when given the general instruction to assess a repository's security posture. Real-world ARTEX and AntiFox reporting now provides evidence that attackers apply similar agentic capabilities during actual intrusions. The era of agentic offensive security is already here, and ARTEX is one of many frameworks capable of participating. AntiFox shows how the same credential attack path works against AWS The latest AntiFox reporting provides another example of attackers following established paths toward credential abuse. According to Arctic Wolf's investigation, infrastructure hosting AntiFox was associated with attacks against internet-facing web applications and AWS environments. One intrusion involved valid AWS credentials, including IAM users and assumed EC2 roles, which were being leveraged. Attackers found and abused identities to enumerate cloud services and test their available permissions. Hundreds of API requests were made within approximately 30 minutes. Some successfully accessed sensitive resources, including production secrets. The attack pattern is all too familiar: the adversary obtained or used credentials, examined the permissions associated with those identities, and attempted to access additional resources. The credentials provided the connection between compromised systems and the resources attackers wanted to reach. This is exactly the security problem GitGuardian addresses through our Credential Layer Security Platform. Faster attacks make existing credential exposure more dangerous Every modern enterprise depends on credentials connecting people, applications, infrastructure, and services. Those connections form the credential layer. An exposed credential can give an attacker access to a trusted identity. The permissions associated with that identity determine which systems and resources are available. Credentials can also lead to additional credentials. A compromised application identity might have permission to retrieve secrets from a vault. Those secrets might then provide access to databases or other cloud services. The potential impact grows as attackers discover and abuse these relationships. Organizations need controls that prevent credentials from becoming exposed in the first place. They also need continuous discovery and enough context to respond effectively when an exposure occurs. Knowing that a credential leaked is the starting point. Knowing which identity it belongs to, what permissions it grants, and what resources it can access allows teams to take meaningful action. Context is what connects discovery to remediation. The emergency response remains Prevent, Detect, Remediate The same immediate actions recommended in our first ARTEX article apply to AntiFox and the broader class of agentic attack frameworks. These are established credential security practices. Their importance increases as attackers become capable of executing more steps with less human intervention. Detect the credentials already exposed Assume attackers are already looking for your credentials. The ARTEX research confirmed attackers searching public GitHub for exposed OAuth application secrets. AntiFox demonstrates the additional risk of credentials exposed through compromised application environments. Organizations need visibility across both scenarios. Right now, you should run a GitHub Security Audit https://www.gitguardian.com/?ref=blog.gitguardian.com to investigate public exposure associated with your developers, including credentials leaked outside repositories your organization directly controls. This is a free service and only takes a few minutes. HasMySecretLeaked https://blog.gitguardian.com/announcing-has-my-secret-leaked/ provides another way to check whether a credential has appeared on public GitHub without revealing the plaintext secret during the lookup. Scan internal repositories and CI/CD environments for hardcoded secrets and check them against this database. When thinking about surfaces to scan, remember that credentials also accumulate on developer laptops. Developer Endpoint Protection https://www.gitguardian.com/developer-endpoint-protection?ref=blog.gitguardian.com helps identify secrets in local configuration files and AI coding tool directories. This can be deployed per machine or through MDM. GitGuardian brings this context together to help teams identify which exposures require immediate attention. Remediate exposed credentials as fast as possible Treat exposed credentials as compromised and revoke or rotate them. Valid credentials for any production systems or sensitive information should be the highest priority. For the AWS environments described in the AntiFox reporting, defenders should investigate unusual IAM activity and unexpected access to AWS resources. Review CloudTrail for successful API calls within bursts of denied requests. Investigate whether compromised identities accessed Secrets Manager or other systems containing additional credentials. Revoke affected AWS sessions and access keys. Rotate credentials exposed through application configuration files and verify whether attackers used those credentials to reach additional resources. Understanding dependencies is essential when rotating credentials used by production applications. Security teams need to know which services will be affected so they can coordinate replacement and avoid unnecessary outages. This is where the power of the exploration map https://blog.gitguardian.com/credential-layer-security-in-practice/ becomes obvious. And remember that removing an exposed secret from a repository or deleting a compromised file does not invalidate the credential. The exposed access remains available until the credential is revoked, rotated, or otherwise rendered unusable. Prevent credentials from spreading While detection is vital, preventing new credentials from becoming available to an attacker or adversarial AI is just as vital. This is why we make ggshield https://www.gitguardian.com/ggshield?ref=blog.gitguardian.com . Our CLI can help you catch hardcoded secrets before they reach repositories through pre-commit and pre-push scanning. You can extend those checks to CI/CD workflows. We highly recommend that everyone using AI agents install our AI Hooks https://blog.gitguardian.com/ai-hooks-ai-coding-assistants/ to add deterministic controls to coding agent workflows. These hooks identify secret-bearing prompts and tool interactions before credentials are exposed through those actions and stop the agent from using or copying those credentials elsewhere. In the longer term, organizations should also reduce standing access wherever possible. Teams should move all applications and non-human identities to short-lived credentials, narrowly scoped permissions, and federated workload identities. These limit the time and resources available to anyone who obtains unauthorized access, greatly reducing the blast radius. This should be part of a larger modernization and defense-in-depth effort to be truly effective at scale. In short, an attacker working at machine speed should encounter credentials that expire quickly and identities with tightly controlled permissions. Better yet, they should encounter no credentials at all. Securing the credential layer is more urgent than ever ARTEX and AntiFox are early examples of a much larger change in offensive security. The underlying techniques have existed for years. Attackers have always exploited vulnerable applications, searched for exposed credentials, and used trusted identities to access valuable resources. The speed and ease of the attack are really all that has changed. This gives experienced attackers more powerful automation and makes sophisticated attack workflows accessible to a broader group of operators. The tools attackers use will continue to evolve. New forks are inevitable. The credential layer remains the common attack surface that security teams need to understand and protect. Run your own GitHub Security Audit https://www.gitguardian.com/?ref=blog.gitguardian.com right now to understand your exposure, or book a demo https://www.gitguardian.com/book-a-demo?ref=blog.gitguardian.com to talk to us about how GitGuardian helps organizations detect, remediate, and prevent credential exposure across their environments. FAQ: What is AntiFox? AntiFox is an offensive agentic AI framework that began as a fork of ARTEX. Researchers at Arctic Wolf linked infrastructure running it to real intrusions involving credential theft and unauthorized cloud access, including attacks on internet-facing web applications and AWS environments. How is AntiFox related to ARTEX? AntiFox started as a fork of ARTEX, the agentic framework Microsoft Threat Intelligence reported attackers using to find exposed credentials on GitHub. Less than a week separated the two reports. New forks are inevitable, and the shared target remains the credential layer. How did attackers use AntiFox against AWS environments? In one intrusion, attackers used valid AWS credentials, including IAM users and assumed EC2 roles, to enumerate cloud services and test their permissions. They sent hundreds of API requests in about 30 minutes. Most were denied, but some succeeded, including operations that exposed production secrets. In a separate incident, valid credentials were used to access S3 objects. Why do agentic attack frameworks make exposed credentials more dangerous? An attacker can give an agent a goal in plain language, and the agent investigates the environment, runs commands, interprets errors, and tries again. Tasks like finding exposed credentials and working out what they can reach used to require far more hands-on expertise. The speed and low cost of that automation shorten the time between exposure and abuse. Do agentic attack frameworks need a built-in secrets scanner? No. GitGuardian researchers analyzed about 45 agentic attack frameworks and found that only four shipped with a working secrets scanner integrated into the agent. In a controlled experiment by researcher Guillaume Valadon, an ARTEX build with no dedicated scanner still found eight of nine planted credentials using ordinary commands like git and grep. The agent started searching within 6 to 13 seconds. How can teams respond to AntiFox-style attacks on AWS credentials? Treat exposed credentials as compromised, then revoke or rotate them, starting with valid credentials for production systems. Review CloudTrail for successful API calls inside bursts of denied requests, and check whether compromised identities reached Secrets Manager or other systems holding more credentials. Revoke affected AWS sessions and access keys, and rotate credentials exposed through application configuration files. Does deleting an exposed secret from a repository fix the problem? No. Removing a secret from a repository or deleting a compromised file does not invalidate the credential. The access remains available until the credential is revoked, rotated, or otherwise rendered unusable. What should organizations do now to reduce exposure? Detect, remediate, and prevent. Run a GitHub Security Audit and check credentials with HasMySecretLeaked, scan internal repositories, CI/CD, and developer laptops, and rotate anything exposed with a clear view of its dependencies. Add ggshield and AI Hooks to stop new exposures, and move toward short-lived credentials, narrowly scoped permissions, and federated workload identities to shrink the blast radius.