Attackers are renting on-demand infrastructure on Alibaba Cloud to run self-managed copies of AntiFox — an open-source, agentic penetration testing platform — then pointing the resulting autonomous agents at web services and AWS environments in search of credentials, according to a report from BleepingComputer.
The campaign exploits no flaw in AntiFox itself. Instead, it follows a pattern the security industry knows well: legitimate, openly available software put to work by adversaries. Attackers stand up their own instances of the agent and let it plan and carry out multi-step reconnaissance and exploitation chains against targets of their choosing.
Autonomy cuts both ways
AntiFox is built to behave like a junior penetration tester — breaking a task into steps, deciding which techniques to try next, and executing them without a human clicking through each action. That autonomy is the product's selling point, and it is also what makes it attractive to operators who lack the skills to run equivalent attacks manually.
The practical effect, as BleepingComputer describes it, is a lower barrier to scaled reconnaissance. An unsophisticated actor can stand up an agent, feed it a target list, and let it work through discovery, probing and initial access attempts with minimal supervision. Multi-step attack chains that once required experienced hands are increasingly delegated to software that runs unattended.
Hosting that infrastructure on Alibaba Cloud's on-demand capacity adds a further wrinkle: instances can be spun up quickly, discarded after use, and are spread across a shared platform, which complicates attribution and takedown efforts.
Why the credentials matter
The end goal is AWS credentials — and that is where the campaign's real risk lies. Keys harvested through this kind of attack are structurally identical to legitimate ones: they authenticate exactly as a developer's or CI pipeline's keys would. That means they typically sail past authentication-focused alerts, and the first clear signal of misuse may only appear as anomalous API activity in account logs.
Countermeasures listed in BleepingComputer's report include enforcing IMDSv2 to block simple metadata-service credential theft, replacing long-lived access keys with short-lived credentials and IAM roles, rotating existing keys, reviewing CloudTrail logs for unusual patterns, and restricting outbound network access from sensitive workloads.
A dual-use problem for the open-source community
The story is a textbook case of dual-use software. Agentic security tools are being adopted legitimately by defenders and testers who want to automate grunt work; the same autonomy scales hostile activity just as effectively. Nothing in the report suggests AntiFox has a vulnerability to patch — the exposure comes from how the tool is deployed, by whom, and whether those deployments are monitored.
That framing matters for the open-source community: responsibility does not end at release. Documentation, deployment guardrails and clear statements about intended use become part of the security posture of any tool capable of acting autonomously.
The same dynamic applies well beyond any single market. Multi-cloud estates are now ordinary, and where roles, keys and network paths are configured loosely, credentials harvested from one platform can be just as usable against resources on another — an agent probing from on-demand infrastructure will not stop at a cloud boundary it was never told about.
The broader lesson is that as attack tooling gains autonomy, intent and access control become the decisive controls. The agent will do what it is told; the question is who is doing the telling, and what credentials it can reach.
據 BleepingComputer 報道，攻擊者正租用阿里雲的按需基礎設施，運行自行管理的 AntiFox 副本——一個開源、具自主能力的滲透測試平台——再將由此產生的自主 agent 指向網絡服務及 AWS 環境，搜尋可用的憑證。
此次攻擊活動並未利用 AntiFox 本身的任何漏洞，而是沿用保安界熟知的模式：將合法、公開可用的軟件交由敵對者使用。攻擊者自行架設 agent 實例，讓它規劃並執行針對所選目標的多步驟偵察及利用鏈。
自主性是一把雙刃劍
AntiFox 的設計目標是模擬初級滲透測試員的行為——將任務拆解為多個步驟，決定下一步嘗試哪些技術，並在無需人工逐步點擊操作的情況下執行。這種自主性正是產品的賣點，同時也令缺乏足夠技術、無法手動進行同類攻擊的操作者紛紛採用。
按 BleepingComputer 的描述，實際效果是大規模偵察的門檻大幅降低。一名攻擊手法不甚老練的行為者可以架設一個 agent，輸入目標清單，讓它在幾乎不需要監督的情況下完成偵測、探測及初步入侵嘗試。以往需要經驗豐富人手執行的多步驟攻擊鏈，如今越來越多交由無需人手看管的軟件處理。
將這類基礎設施部署在阿里雲的按需資源上，更增添了另一層複雜性：實例可以快速啟動、用後即棄，而且分散於共享平台上，令歸因溯源及取締行動倍加困難。
為何這些憑證至關重要
最終目標是 AWS 憑證——攻擊活動的真正風險正在於此。透過這類攻擊取得的密鑰，在結構上與合法密鑰完全相同：其認證表現與開發者或 CI pipeline 的密鑰別無二致。這意味著它們通常能避過以認證為核心的警報，而濫用行為的首個明顯跡象，往往只會以帳戶日誌中的異常 API 活動形式浮現。
BleepingComputer 報告列出的應對措施包括：強制啟用 IMDSv2 以阻擋簡單的 metadata service 憑證盜取、以短效憑證及 IAM role 取代長期有效的 access key、輪換現有密鑰、檢視 CloudTrail 日誌中的異常模式，以及限制敏感工作負載的外部網絡存取。
開源社區面臨的兩用性問題
這則新聞是兩用性軟件（dual-use software）的教科書式案例。Agentic 安全工具正被防禦方及測試人員合理採用，以自動化繁瑣的例行工作；而同樣的自主性，亦能同樣有效地擴大敵對活動的規模。報告中沒有任何內容顯示 AntiFox 存在需要修補的漏洞——風險來自於工具如何部署、由誰部署，以及這些部署是否受到監控。
這一定位對開源社區意義重大：責任並不止於發布軟件。技術文件、部署防護措施，以及關於預期用途的清晰聲明，都是任何具備自主行動能力的工具安全態勢的一部分。
這一動態同樣適用於遠超單一市場的範圍。Multi-cloud 環境如今已屬常態，凡角色、密鑰及網絡路徑配置鬆散之處，從一個平台竊取的憑證同樣可以用於攻擊另一個平台的資源——從按需基礎設施出發的 agent，不會因為從未被告知有雲端邊界的存在而停下腳步。
更廣泛的教訓是：隨著攻擊工具日益具備自主性，意圖與存取控制（access control）將成為決定性的防線。Agent 會執行收到的指令；問題在於誰在下達指令，以及它可以接觸到哪些憑證。