Cloud Security · Credential Theft

Typosquatted phishing campaign harvests AWS console credentials

Operators used stolen material to access at least one account within 20 minutes from Mullvad VPN IPs.

2 sources · Mar 10

Timeline

• Mar 10 Reported by Help Net Security
• Mar 9 Reported by Datadog Security Labs

Sources

• Mar 10 Help Net Security

  Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts - Help Net Security

  AWS accounts holders are targeted with fake security alerts and redirected to a clone of the AWS Management Console sign-in page.

  original

• Mar 9 Datadog Security Labs

  Behind the console: Active phishing campaign targeting AWS console credentials | Datadog Security Labs

  Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure.

  original

Part of the PlainSec briefing for 2026-03-09

Every edition of this story: Typosquatted phishing campaign harvests AWS console credentials