Cloud · 203 giorni fa

AWS Console Credentials Harvested; Accounts Accessed Within 20 Minutes

Datadog observed an active adversary-in-the-middle phishing campaign that proxied AWS sign-in pages to capture validated Console credentials and OTPs. Operators used captured material to access at least one account within 20 minutes from Mullvad VPN IPs. Block the typosquatted domains, enforce

Cronologia

• 10 mar Segnalato da Help Net Security
• 9 mar Segnalato da Datadog Security Labs

Fonti

2 fonti che coprono questa storia

• Help Net Security 10 mar

  Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts - Help Net Security

  AWS accounts holders are targeted with fake security alerts and redirected to a clone of the AWS Management Console sign-in page.

• Datadog Security Labs 9 mar

  Behind the console: Active phishing campaign targeting AWS console credentials | Datadog Security Labs

  Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure.

Part of the PlainSec briefing for 2026-03-15

Editions

• Briefing for 2026-03-11
• Briefing for 2026-03-09