Loading malware…
AlienFox is a modular cloud-focused infostealer and attack toolkit used to harvest credentials and API secrets from exposed web application configuration files and abuse cloud, email, and messaging accounts. Versions 2 through 4 have been observed dating from February 2022. It is primarily distributed through Telegram as source-code archives, with some modules publicly available on GitHub. Targeting is opportunistic and includes misconfigured deployments of Laravel, Drupal, Joomla, Magento, OpenCart, PrestaShop, and WordPress.
AlienFox discovers targets through IP and subnet probing, search engines, and services such as LeakIX and SecurityTrails. It parses exposed configuration data to extract credentials for providers including AWS, Microsoft Office 365, Google Workspace, Twilio, SendGrid, Mailgun, and Zoho. Its modules validate harvested credentials, inspect AWS Simple Email Service sending quotas and configured email identities, and facilitate email and SMS spam through compromised services. Later versions automate post-compromise activity, including creation of privileged AWS IAM users, privilege escalation, and persistence. Additional modules identify content management systems and collect target lists. AlienFox shares credential-scraping code with Androxgh0st-derived tooling and has functional overlap with GreenBot and other cloud-abuse toolkits.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SentinelLABS analyzed several iterations of “AlienFox,” a comprehensive toolset for harvesting credentials for multiple cloud service providers.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers use AlienFox to harvest API keys & secrets from popular services including AWS SES & Microsoft Office 365.
The target generation scripts use a combination of brute force for IPs and subnets, as well as web APIs for open-source intelligence platforms to provide details about potential targets.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cloud infostealer referenced for distribution overlap with the same Telegram channel credited in older Xeon Sender versions.
Cloud-focused attack tool family referenced as sharing Androxgh0st-derived credential scraping code and used for compromising cloud-related services.
Modular toolkit that discovers exposed configuration files and extracts cloud, email, and service credentials. The content describes newer versions automating credential abuse, creating administrative AWS IAM users for persistence, and escalating privileges. Stolen credentials can subsequently enable cloud resource abuse, including LLMjacking.
A cloud-focused tool used for spamming activity against cloud or SaaS environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.