AntiFox AI agents hosted on AWS for credential theft

Attackers are deploying AntiFox, an open-source agentic penetration-testing platform, on Alibaba Cloud instances to target web services and AWS environments. The tool automates reconnaissance and exploitation tasks, enabling attackers to steal credentials at scale. Organizations should monitor for suspicious AntiFox activity, restrict cloud IAM permissions, and implement multi-factor authentication to mitigate credential theft risks in AWS environments.