Researchers warn AntiFox is driving attacks on AWS environments

A month after Artex went closed-source, researchers say the agentic pentesting framework is spreading quickly and causing increasing disruption. Dark Reading cites Yuval Itzchakov, cofounder and CTO of A Security, describing Artex as a tool that can identify multiple flaws within about 45 minutes and chain them into an attack path that can bypass a WAF, CAPTCHA and MFA. The article notes that the original Artex was de-listed on 8 October, but new variants such as AntiFox have emerged.

Arctic Wolf Labs reports that AntiFox has been used to target Internet-facing web services and AWS environments, breaching IIS servers, deploying web shells, enumerating services, exposing secrets, and manipulating S3 buckets across AWS accounts. The piece stresses that the defenders’ challenge is less about capability and more about willingness, with emphasis on traditional cybersecurity hygiene, IoC hunting, credential rotation, and session revocation.

The reporting highlights that Artex/AntiFox attacks are loud and visible, leaving indicators in pod names and probes and triggering detections in environments with EDR. Guillaume Valadon of GitGuardian urges blue teams to rely on SIEM and strong detection capabilities to pick up these tools amidst the noise, while Justin Moore of Arctic Wolf stresses a defence-in-depth approach and heightened focus on secrets management, as the tools frequently discover credentials.

The article also quotes Eye Research on the intrinsic simplicity and speed of these agentic attacks, noting that much of the recommended defence comprises established best practices: monitor for exposed keys, review Git repositories for secrets, and limit permissions and access, with defenders improving their posture to keep pace with faster evolution of such frameworks.