al-ice.ai

1,428 Consoles and a Production Secret: AntiFox Rides the 45-Framework Agentic Attack Wave

Agent & Supply Chain Security by al-ice.ai Editorial

On 11 November 2026 The Hacker News (Ravie Lakshmanan) reported Arctic Wolf Labs findings that an emerging agentic penetration-testing platform called AntiFox has been used in live intrusions to steal AWS credentials and read a production secret. Two days earlier, on 9 November 2026, GitGuardian published the census that puts AntiFox in context: “Beyond ARTEX: 45 AI Pentesting Tools and How to Find Them” catalogs ~45 open-source frameworks that wire a language model into a loop that runs tools and acts on their output — with 1,428 ARTEX-family operator consoles exposed on Shodan as of 7 November 2026. ARTEX was one framework. The field around it is now a measurable, scannable attack surface, and AntiFox is the newest member observed crossing from tooling into confirmed cloud intrusion.

What AntiFox did inside real environments

AntiFox is an AI-driven autonomous pentest platform downloadable from GitHub (474 stars, 251 forks at time of reporting). Its README describes a planner/worker/main-agent multi-agent system over a dual-graph core — a global asset graph plus a per-task exploration graph — running recon, attack-surface discovery, exploitation, finding capture, and report delivery, “fully observable, interactive, and deliverable.” Its pitch is that most automated pentest tools are “great at discovery, but stop at discovery,” while AntiFox converts findings into engineer-readable, reproducible, evidence-backed reports.

Per Arctic Wolf, as carried by THN: in several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments. One intrusion path started at a compromised internet-facing IIS application: access through the affected web app was leveraged to create an ASPX web shell via w3wp.exe (the IIS worker process), then run OS commands — PowerShell hunts for web.config files and configuration backups, reading application settings and database connection strings, enumerating debug and error-log directories, attempting to connect to an internal production database with a credential taken from application configuration, and copying configuration and log files into a web-accessible upload directory. The exact initial-access vulnerability is not known. In other attacks, the actor reportedly started with a valid AWS credential obtained through as-yet-undetermined means.

The cloud phase is the part defenders should study. Abusing valid IAM identities, the activity validated credentials and enumerated dozens of services — IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock. Most authenticated cross-service calls ended in AccessDenied — but some discovery and secret-access operations succeeded, including, in at least some instances, progression beyond Secrets Manager enumeration to a successful GetSecretValue request against a production secret, plus S3 discovery and object operations under a valid identity. Arctic Wolf’s summary line, carried as reported: agentic frameworks make pentest techniques more accessible to threat actors while increasing the speed and consistency with which they are applied in live attacks.

GitGuardian’s census: 45 frameworks, four with scanners, none with the full pipeline

GitGuardian’s 9 November technical investigation is the first systematic count of the field ARTEX opened. Of ~45 open-source agentic attack frameworks, the team cataloged 32 into five families (the rest are forks and variants): network kill chain (PentAGI with Nmap/Metasploit/sqlmap agent teams, RedAmon’s attack-surface graph, DarkMoon’s 50 specialist agents across web, cloud, AD, and CI/CD), web-app and API (Strix at 74.2k stars, PentestGPT), C2-integrated (Sage and echidna as LLM operators inside Mythic, ARTEX derivatives Pojun, FORANG, ycode, and the Korean-localized ScopeWeaver fork), harnesses wrapping coding agents like Claude Code and Codex with offensive skills (RAPTOR, CyberStrike, Cybermes), and research prototypes (Incalmo, HackSynth, VulnBot) — plus three threat-reporting additions: Cairn (no auth by default), HexStrike (an MCP server exposing 150+ offensive tools to any MCP client, no auth by default), and Agent Zero (19.8k stars, no auth by default, already experimented with by threat actors).

The secret-hunting audit is the sharpest finding. GitGuardian read the shortlisted tools at pinned commits and graded what each ships for finding secrets on public GitHub. Only four — Pojun, Cybermes, Xalgorix, and AIRecon — ship a real scanner wired to the agent (Pojun names gitleaks in its worker prompt plus a default skill pointing at public GitHub; Cybermes ships its own 48-pattern secret_scan binary with 13 GitHub code-search dorks and nine credential validators; Xalgorix and AIRecon name gitleaks and trufflehog with GitHub-search checklists and dork skills). None contains a GitHub fetcher — and it doesn’t matter: nearly every framework hands its agent a shell and web access, so a GitHub search or scanner download is one improvised tool call away. GitGuardian’s lab result, via Dark Reading: ARTEX ships no secret scanner, yet in a sealed lab it found eight of nine secrets in every run where it acted, including an AWS key recovered from git history. The repository doesn’t ship the capability; the model plus a prompt supplies it.

On exposure: of the ~45 frameworks, 41 were fingerprinted for Shodan (56 fingerprint records); 11 serve a web UI on a network port by default, 18 serve a UI only in some setups, 12 have no listener. The ARTEX family alone matched 1,428 Shodan services on 7 November 2026, led by count, with Agent Zero at 173 (39 openly accessible) and PentAGI at 419 in some setups. ARTEX’s own history explains the sprawl: published to GitHub in July by independent developer Autumn-27, taken down by its creator on 8 October 2026 — 74 days after the first commit — after threat actors used it to hunt secrets and move laterally. The takedown didn’t work: 102 forks and ARTEX-named repositories appeared in the takedown week alone.

The corroborating counts — and what they disagree on

Three independent measurements now agree on the order of magnitude while differing on method, which is worth stating plainly. Censys observed 1,465 internet-exposed ARTEX consoles as of 4 November 2026 (most in the US, Hong Kong, China, Japan, Singapore, and South Korea), estimating actual global use higher since exposure isn’t required for use — carried via THN and Dark Reading. Check Point Research identified 2,557 systems hosting ARTEX, including 10 misconfigured instances exposing full databases — carried via THN. GitGuardian’s Shodan-based 1,428 (7 November) is the family-scoped count. All three agree exposure is widespread; none claims every instance is malicious.

Dark Reading’s 10 November synthesis (Alexander Culafi) adds operator texture from Check Point: ARTEX required remarkably little interaction once an objective was set — operators issued a goal and left the agent fleet to work, checking progress or adjusting priorities. Observed objectives skew opportunistic: cryptocurrency theft, Apple code-signing certificates, gaming accounts, DoS against gambling sites, exploiting weak or hard-coded passwords, missing auth, IDOR, and RCE. And THN’s AntiFox piece carries one more thread worth watching separately: VECERT’s Operation Ghost-Campus, a Chinese-actor campaign using AI agents for perpetual free LLM access via mass fofa.info account creation, stolen OpenAI/DeepSeek API keys with balance verification, a GoTTY “Pi — AI Coding Assistant” terminal, and academic-fraud bots plus data theft affecting 5,000+ students at the Fengxian Campus — carried as reported, primary not independently reviewed.

What this means next to everything else we track

This is the census-and-console half of an ARTEX story this site has tracked through its incidents: Storm-0940’s 2,900-sign-ins-a-minute password spray and ConnectWise pivot (also recapped in Dark Reading’s synthesis — linked, not restated), Vapor Panda’s DeepSeek-driven espionage, the CrowdStrike operator session-log trawl, and the backdoored ARTEX image handing installers a root shell. GitGuardian plus Censys plus Check Point now supply the missing denominator: the operator infrastructure is itself internet-visible by the thousand. The AWS angle connects directly to our Qubole cross-account trust coverage — valid cloud identities, abused at machine speed — and the five-minutes-GitHub-to-Key-Vault observation Microsoft reported (carried via Dark Reading) is the same pipeline our “Don’t Ask Again” secret-exposure briefing warned feeds: 2,539 secrets, one settings file, public GitHub. The MITRE framing also just updated — see our ATT&CK v20 AI-techniques briefing.

What to actually do

  1. Treat exposed agentic consoles as compromised until proven otherwise. Hunt your address space and cloud estates against the published fingerprints: ARTEX-family web UIs, Agent Zero on 5080/50080, PentAGI on 8443/8666/8765, Cairn on 8000, RedAmon on 3000/443. Censys and GitGuardian agree low operational discipline is the norm — many deployments sit open with default or no auth.
  2. Scope Secrets Manager/KMS so a single valid identity can’t reach production. The AntiFox intrusions mostly hit AccessDenied — the control worked. The failure was wherever one identity could progress to GetSecretValue on a production secret. Separate production secret access onto its own role with no standing attachment to web-tier identities.
  3. Assume agents improvise the tooling you didn’t ship. GitGuardian’s core lesson: grading tools by shipped scanners misses the point when every harness hands the agent a shell and web access. Block the egress and execution paths (GitHub code-search exfil patterns, scanner downloads on agents) rather than auditing which scanner a repo bundles.
  4. Fix IIS-to-cloud credential paths, not just the web shell. The AntiFox path ran web.config → connection string → production database → upload directory. IIS app identities should never resolve to credentials valid against production data stores; rotate anything a web-readable config ever held.
  5. Feed the 45-framework catalog into threat intel, not just ARTEX rules. Detections keyed to ARTEX strings miss Pojun, Cybermes, Xalgorix, AIRecon, HexStrike’s 150-tool MCP surface, and Agent Zero — all fingerprinted for internet scanning in the GitGuardian report. Track the family, not the flagship.

Our verification was read-only. We read the full GitGuardian “Beyond ARTEX” report first-hand (9 November 2026: ~45 frameworks, 32-in-five-families catalog, four Provisioned secret-hunting grades with per-tool mechanisms, 56 Shodan fingerprints, 1,428 ARTEX-family Shodan services on 7 November, 8 October takedown with 102 takedown-week forks, star/push table as of 7 November). We read The Hacker News AntiFox report first-hand in full (Ravie Lakshmanan, 11 November 2026: Arctic Wolf findings, Alibaba Cloud-hosted interfaces, IIS/w3wp.exe ASPX shell sequence, enumerated AWS service list, GetSecretValue-on-production-secret and S3 outcomes, 251 forks/474 stars, dual-graph README description, VECERT Ghost-Campus and Censys/Check Point figures as carried therein). We read Dark Reading’s ARTEX synthesis first-hand in full (Alexander Culafi, 10 November 2026: July publication, Storm-3358/Storm-0940/Vapor Panda/CERT-In recap, Censys 1,465 figure, GitGuardian lab 8-of-9 result, Winterfeld/Snyder/Cutler guidance). Storm-0940/ConnectWise specifics are linked from our prior briefing, not restated; VECERT Ghost-Campus details are carried as reported via THN. We ran no agent framework, scanned nothing, exposed no console, enumerated no cloud service, and contacted no vendor. Brave Search was used for discovery only.

Sources: