AntiFox AI Agents Exploit AWS and IIS Server Vulnerabilities to Steal Production Secrets
Researchers have uncovered attacks leveraging AntiFox, an AI agentic penetration-testing framework forked from ARTEX, to target internet-facing Microsoft IIS web servers and AWS environments. Attackers deployed ASPX webshells to execute OS commands, retrieve configuration files, and exfiltrate secrets such as database connection strings. In AWS, compromised valid identities, including IAM users and EC2 roles, were used to perform mass API requests to enumerate permissions and access sensitive S3 objects. While many API calls were denied, successful operations still exposed production secrets, demonstrating that access denials did not fully protect the environment. These incidents highlight the risk posed by agentic AI frameworks automating reconnaissance and credential theft, and reinforce the need for continuous secret scanning, credential rotation, and least privilege enforcement to prevent compromise and abuse of leaked credentials.
Linha do tempo
-
AntiFox AI Agents Exploit AWS and IIS Server Vulnerabilities to Steal Production Secrets
ler a análise desta fonte ocultar
Researchers have uncovered attacks leveraging AntiFox, an AI agentic penetration-testing framework forked from ARTEX, to target internet-facing Microsoft IIS web servers and AWS environments. Attackers deployed ASPX webshells to execute OS commands, retrieve configuration files, and exfiltrate secrets such as database connection strings. In AWS, compromised valid identities, including IAM users and EC2 roles, were used to perform mass API requests to enumerate permissions and access sensitive S3 objects. While many API calls were denied, successful operations still exposed production secrets, demonstrating that access denials did not fully protect the environment. These incidents highlight the risk posed by agentic AI frameworks automating reconnaissance and credential theft, and reinforce the need for continuous secret scanning, credential rotation, and least privilege enforcement to prevent compromise and abuse of leaked credentials.