{"slug": "antifox-the-aws-breach-where-most-requests-were-denied", "title": "AntiFox: The AWS Breach Where Most Requests Were Denied", "summary": "A self-hosted AI pentest platform forked from ARTEX compromised an IIS web application, extracted AWS credentials from web.config, and made hundreds of API calls across 18 services in roughly 30 minutes, with most returning AccessDenied but one yielding a production secret. The writeup argues denial counts are the wrong detection metric, since each AccessDenied narrows the permission boundary, and recommends alerting on successful GetSecretValue calls from hosting-provider ASNs, hunting single source IPs cycling IAM users, and correlating IIS web-shell activity with CloudTrail. It also notes that deleting a leaked key is not remediation because the resulting STS session outlives it — active sessions must be revoked first.", "body_md": "An AI pentest platform forked from ARTEX, self-hosted on Alibaba Cloud, compromised an IIS web application, extracted AWS credentials from web.config, and made hundreds of API calls across 18 services in approximately 30 minutes.\n\nMost returned AccessDenied. One returned a production secret.\n\nWhy the denial count is the wrong metric\n\nAn agent enumerating a permission boundary doesn’t stop after a few failures — it has no reason to. Each AccessDenied narrows the boundary. The burst isn’t a failed intrusion; it’s the search phase of a successful one.\n\nWhat actually works for detection\n\nAlert on successful GetSecretValue from hosting-provider ASNs that have never touched the account\n\nHunt for a single source IP cycling multiple IAM users or assumed roles in a short window\n\nTie IIS web-shell activity (w3wp.exe spawning cmd.exe/powershell.exe) to subsequent AWS CloudTrail activity — the two halves of this intrusion are minutes apart, not days\n\nRemediation note\n\nDeleting a leaked AWS key is not remediation. The STS session that key produced outlives it. Revoke active sessions first, review CloudTrail for the affected identity, then rotate.\n\nThere is no CVE here — the tool is legitimate, the credentials were valid. The exposure is the permission set.\n\nFull breakdown including the GitGuardian ARTEX lab test, Vapor Panda lineage, and the full IOC list: ThreatAft", "url": "https://wpnews.pro/news/antifox-the-aws-breach-where-most-requests-were-denied", "canonical_source": "https://dev.to/threataft_dev/antifox-the-aws-breach-where-most-requests-were-denied-2pj0", "published_at": "2026-11-12 04:17:22+00:00", "updated_at": "2026-11-12 04:21:10.030937+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents"], "entities": ["ARTEX", "AWS", "Alibaba Cloud", "GitGuardian", "ThreatAft", "Vapor Panda", "IIS", "CloudTrail"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/antifox-the-aws-breach-where-most-requests-were-denied", "markdown": "https://wpnews.pro/news/antifox-the-aws-breach-where-most-requests-were-denied.md", "text": "https://wpnews.pro/news/antifox-the-aws-breach-where-most-requests-were-denied.txt", "jsonld": "https://wpnews.pro/news/antifox-the-aws-breach-where-most-requests-were-denied.jsonld"}}