{
  "Event": {
    "analysis": "1",
    "date": "2026-06-24",
    "extends_uuid": "",
    "info": "[Threat Intel] Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond",
    "protected": false,
    "publish_timestamp": "1782533496",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782533496",
    "uuid": "96943259-80f4-4b49-9c7f-89e4e3325aea",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#682cad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf01b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"",
        "relationship_type": ""
      },
      {
        "colour": "#2da3e8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"",
        "relationship_type": ""
      },
      {
        "colour": "#65d24c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#2e58ce",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Datadog\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442817",
        "to_ids": false,
        "type": "link",
        "uuid": "7a000174-fc37-433b-a713-92f95166d9f0",
        "value": "https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442817",
        "to_ids": false,
        "type": "text",
        "uuid": "c9866a06-6b31-4ec3-9713-9d966c1ed9d3",
        "value": "Between June 16 and 19, 2026, a sophisticated adversary-in-the-middle phishing campaign targeted AWS console users through three domains registered within 48 hours and hosted on Cloudflare. The campaign impersonated AWS login pages and captured credentials along with real-time multi-factor authentication codes through email, SMS, and authenticator apps. Phishing emails were delivered through legitimate platforms like SendGrid and Nimbu to bypass spam filters. The kit employed JavaScript-based credential harvesting with victim validation through encrypted URL parameters, preventing sandbox analysis. Targets were primarily US-based software engineers and engineering leadership, suggesting a curated target list rather than mass phishing. The same kit was linked to concurrent SendGrid impersonation campaigns and previous cryptocurrency wallet targeting since July 2025. The small sample of fewer than 50 targeted email addresses indicates highly selective targeting of technical personnel with AWS access."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442817",
        "to_ids": false,
        "type": "text",
        "uuid": "1c0ccfb2-b185-4a2d-8ed7-9db4878d31d7",
        "value": "Name: Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond\nAuthor: AlienVault\nAdversary: \nTags: [\"sendgrid\", \"mfa bypass\", \"aws\", \"cloudflare\", \"phishing\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: []\nAttack_ids: [\"T1566\", \"T1140\", \"T1021\", \"T1185\", \"T1539\", \"T1114\", \"T1112\", \"T1590\", \"T1589\", \"T1090\", \"T1598\", \"T1056\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528154",
        "to_ids": true,
        "type": "domain",
        "uuid": "9ca00e3d-c390-4ddd-b7d2-e318747d647b",
        "value": "loginportal-aws.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528175",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9642c0fc-6807-4a95-bb4c-9c172ecea4d8",
        "value": "aws-central.us-west-login.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528196",
        "to_ids": true,
        "type": "hostname",
        "uuid": "f9c1b9ac-a861-4d84-b3ec-73d753555c5c",
        "value": "aws.us-east-prod.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528217",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1ee8e5ea-7628-426e-97c8-a14891b3c76f",
        "value": "aws.us-west-login.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}