Loading story…
SentinelLABS reported that AlienFox is a modular toolkit used to steal credentials and API secrets from misconfigured cloud and SaaS email environments, with a particular focus on AWS SES and Microsoft Office 365. The toolkit has been distributed mainly through Telegram, with some components also appearing on GitHub, and operators use internet-exposed asset sources such as LeakIX and SecurityTrails to find vulnerable hosts. Once access is found, AlienFox parses configuration and environment files on exposed servers to extract secrets that can be reused for follow-on abuse.
Later AlienFox versions automate several post-compromise actions, including AWS persistence, privilege escalation, SES quota collection, and bulk spam activity using stolen credentials. SentinelLABS said versions 2 through 4 have been observed since February 2022 and noted recurring overlap with tooling previously tracked as Androxgh0st and GreenBot. The activity reflects a broader shift in cloud-focused crime away from pure cryptomining and toward opportunistic abuse of smaller cloud services for fraud, spam, and account compromise.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
SentinelLABS identified Predator AI, a Python-based infostealer and hacktool advertised on Telegram that targets cloud services and web applications. The report detailed its overlap with AlienFox and related toolsets, plus a ChatGPT-enabled interface used to handle more than 100 attack-related use cases.
SentinelLABS reported observing AlienFox versions 2 through 4 dating from February 2022 onward. The toolkit was described as a modular, evolving framework used to harvest credentials and API secrets from misconfigured cloud and SaaS email services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelOne reported that **FBot**, a Python-based cloud and web attack tool, is being used to harvest credentials and hijack accounts across **AWS**, **Office 365**, **PayPal**, **SendGrid**, **Twilio**, and exposed web application configuration files. The malware scans Laravel, PHP, and AWS-related paths for leaked secrets, validates stolen or discovered accounts, and includes functions to generate AWS-style access key formats and SendGrid-style API keys. Researchers said FBot shares operational similarities with cloud-focused malware such as AlienFox, GreenBot, Predator, and Legion, but does **not** appear to reuse the common **Androxgh0st** codebase. The tool shows a strong emphasis on AWS abuse for follow-on operations, including checking **SES** sending quotas, creating a privileged **IAM** user, and enumerating **EC2** quotas across regions, behavior consistent with account takeover and spam enablement. SentinelOne observed FBot samples dating from July 2022 through January 2024, with limited evolution and no clear public distribution channel, suggesting it may be privately developed or selectively shared. The report urged defenders to enforce **MFA** for AWS programmatic access and monitor for newly created AWS users and significant SaaS mail configuration changes as indicators of compromise or abuse.
Jun 29, 2026
Researchers reported that a cloud-focused credential theft campaign broadened beyond **AWS** to also target **Microsoft Azure** and **Google Cloud Platform**, using exposed Docker services as an initial access point. The activity, observed in June 2023 and detailed by SentinelLABS and Permiso, relied on modular shell scripts and a **UPX-packed Golang ELF** payload to collect cloud credentials, profile compromised hosts, inspect containers, and harvest environment variables from running processes. The tooling also showed worm-like behavior by scanning for exposed Docker daemons on ports `2375` and `2376` with utilities including `masscan` and `zgrab`, then exfiltrating stolen data to **AnonDNS-hosted infrastructure** protected by hardcoded HTTP credentials. Researchers said the tradecraft overlaps with tooling previously linked to **TeamTNT**, but stopped short of firm attribution because the scripts are easily reused or modified; they assessed the actor is actively refining the malware for broader cloud-focused operations against Azure and GCP environments.
Jun 29, 2026
SentinelOne reported that **Xeon Sender**, a Python-based cloud attack tool, is being used to send bulk SMS spam and smishing messages through legitimate APIs at multiple SaaS messaging providers using stolen or otherwise valid customer credentials. The tool was first observed in 2022 and has since been repeatedly rebranded by different threat actors, while retaining largely the same codebase and functionality across versions. Xeon Sender supports nine SMS providers and includes features for credential checking, phone number validation, and number generation, enabling operators to automate large-scale message delivery through provider-specific libraries or crafted HTTP requests. Researchers said the activity reflects abuse of compromised accounts rather than software flaws in the providers, and highlighted defensive indicators including anomalous SMS permission changes, recipient list uploads, and suspicious API activity such as `GetSMSAttributes` and `SetSMSAttributes` in AWS environments.
Jul 12, 2026