Cloud · 234 days ago

Typosquatted phishing campaign harvests AWS console credentials

Operators used stolen material to access at least one account within 20 minutes from Mullvad VPN IPs.

Timeline

• Mar 10 Reported by Help Net Security
• Mar 9 Reported by Datadog Security Labs

Sources

2 sources covering this story

• Help Net Security Mar 10

  Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts - Help Net Security

  AWS accounts holders are targeted with fake security alerts and redirected to a clone of the AWS Management Console sign-in page.

• Datadog Security Labs Mar 9

  Behind the console: Active phishing campaign targeting AWS console credentials | Datadog Security Labs

  Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure.

Part of the PlainSec briefing for 2026-03-11

Editions

• Briefing for 2026-03-11
• Briefing for 2026-03-09

Related stories

• Experience Cloud guest misconfigurations expose customer data