Loading story…
Datadog Security Labs reported an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Management Console users with high-fidelity cloned login pages hosted on typosquatted domains. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to validate credentials and capture session material (and likely MFA/OTP codes) before redirecting victims, enabling rapid post-compromise access to cloud environments.
In an observed case, the threat actor accessed a compromised AWS account within ~20 minutes of credential submission, with console access originating from 185.209.196.132 (identified as a Mullvad VPN egress). Datadog identified two active infrastructure clusters and a third related domain, including cloud-recovery[.]net (IP 178.16.54[.]142), cloud-policy[.]com (IP 69.67.172[.]30), and cloud-recovery[.]us, with shared registrar metadata (Registrar ID 3254, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is credential theft rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender noreply@security[.]aws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Datadog said AWS Security was coordinating disruption and takedown actions against the phishing infrastructure. At the time of reporting, the campaign was still active.
Datadog Security Labs publicly detailed the campaign, identifying active infrastructure clusters on cloud-recovery[.]net and cloud-policy[.]com and a related inactive domain, cloud-recovery[.]us. The report also noted related phishing-kit servers tied to Microsoft 365 and Apple iCloud lures, suggesting broader reuse of the same kit.
In one observed case, attackers logged into a victim's AWS account within 20 minutes of credential submission, using a Mullvad VPN egress IP. The phishing kit acted as a real-time reverse proxy to capture credentials, likely MFA codes, and session material before redirecting the victim.
Datadog observed infrastructure changes on February 26, 2026, indicating ongoing maintenance and rotation of the phishing operation's domains and backend systems. The campaign used rapidly registered and rotated typosquatted domains to evade detection and takedown.
Datadog reported that an adversary-in-the-middle phishing campaign targeting AWS Management Console credentials had been running since late February 2026, and possibly earlier. The operation used fake security alert emails and typosquatted domains to lure victims to high-fidelity AWS login clones.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecuritylabs.datadoghq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Datadog Security Labs reported a targeted adversary-in-the-middle phishing campaign that impersonated the AWS sign-in experience to steal console credentials and capture MFA codes in real time, enabling attackers to hijack active sessions. The operation used at least three AWS-themed domains registered through **NICENIC INTERNATIONAL GROUP CO., LIMITED** and hosted behind **Cloudflare**, with cloned login pages and server-side logic that handled email, SMS, and authenticator-app MFA prompts. Phishing emails posing as **AWS Support** were sent through legitimate delivery services including **SendGrid** and **Nimbu** to improve deliverability and credibility. Researchers said the kit rendered pages only for pre-validated targets using an encrypted URL parameter, `input_24`, a gating method that likely tied each link to a specific victim and reduced exposure to sandboxes and scanners. Fewer than 50 target addresses were recovered, most tied to US-based software engineers and engineering leaders, and investigators also found a likely attacker validation batch file on VirusTotal. Datadog linked the infrastructure and tradecraft to a broader phishing-kit family previously used in campaigns impersonating **SendGrid**, **Salesforce**, and cryptocurrency wallet brands, indicating a reused and increasingly refined framework that defenders should track through suspicious DNS activity and anomalous **AWS CloudTrail** `ConsoleLogin` events.
Jul 12, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026
Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (**SES**) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (**IAM**) access keys discovered in public GitHub repositories, `.env` files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass **SPF**, **DKIM**, and **DMARC**, reducing the effectiveness of reputation-based filtering. Observed campaigns included fake **DocuSign** notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to **AWS Trust & Safety**.
Jun 29, 2026