Hackers use AntiFox AI agents in AWS credential-theft attacks

Attackers are using self-managed AntiFox instances hosted on Alibaba Cloud to target web services and AWS environments. Observed activity included vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting.