Security AlertHigh
AntiFox linked to AWS credential theft and webshell attacks
Nov 11, 2026 · Summarized by Fundy Tech from SecurityWeek
The 30-second version
Researchers say attackers used Alibaba Cloud-hosted AntiFox instances to target web services and AWS environments. They obtained production secrets in some cases.
Key points
- AntiFox was used for exploitation, webshells and secret harvesting.
- Arctic Wolf saw valid AWS identities used in attacks.
- Attackers copied and deleted S3 objects in one incident.
Why it matters
Businesses using AWS should watch for unusual identity use and bursts of denied requests. Webshell activity on internet-facing servers can also be a warning sign of broader compromise.
Who’s affected: AWS and web service environments
What to do
- Review AWS API activity and denied requests.
- Rotate exposed credentials and revoke affected sessions.
- Check internet-facing servers for webshells.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.