Loading story…
SentinelOne reported that FBot, a Python-based cloud and web attack tool, is being used to harvest credentials and hijack accounts across AWS, Office 365, PayPal, SendGrid, Twilio, and exposed web application configuration files. The malware scans Laravel, PHP, and AWS-related paths for leaked secrets, validates stolen or discovered accounts, and includes functions to generate AWS-style access key formats and SendGrid-style API keys. Researchers said FBot shares operational similarities with cloud-focused malware such as AlienFox, GreenBot, Predator, and Legion, but does not appear to reuse the common Androxgh0st codebase.
The tool shows a strong emphasis on AWS abuse for follow-on operations, including checking SES sending quotas, creating a privileged IAM user, and enumerating EC2 quotas across regions, behavior consistent with account takeover and spam enablement. SentinelOne observed FBot samples dating from July 2022 through January 2024, with limited evolution and no clear public distribution channel, suggesting it may be privately developed or selectively shared. The report urged defenders to enforce MFA for AWS programmatic access and monitor for newly created AWS users and significant SaaS mail configuration changes as indicators of compromise or abuse.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-07, SentinelOne published a report detailing FBot's capabilities, including AWS account takeover functions, SaaS account validation, and scanning for exposed secrets in web applications. The report recommended MFA for AWS programmatic access and monitoring for new AWS users and major SaaS mailing configuration changes.
SentinelOne said it observed FBot samples through January 2024 and noted limited evolution over that period. The report also assessed that FBot did not appear to reuse the common Androxgh0st codebase, despite functional similarities to related cloud-focused malware families.
SentinelOne reported observing FBot, a Python-based malware and attack tool targeting cloud and payment services, in samples dating from July 2022. The tooling targeted services including AWS, Office365, PayPal, Sendgrid, Twilio, and exposed web application configuration files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS reported that **AlienFox** is a modular toolkit used to steal credentials and API secrets from misconfigured cloud and SaaS email environments, with a particular focus on **AWS SES** and **Microsoft Office 365**. The toolkit has been distributed mainly through Telegram, with some components also appearing on GitHub, and operators use internet-exposed asset sources such as **LeakIX** and **SecurityTrails** to find vulnerable hosts. Once access is found, AlienFox parses configuration and environment files on exposed servers to extract secrets that can be reused for follow-on abuse. Later AlienFox versions automate several post-compromise actions, including AWS persistence, privilege escalation, SES quota collection, and bulk spam activity using stolen credentials. SentinelLABS said versions 2 through 4 have been observed since February 2022 and noted recurring overlap with tooling previously tracked as **Androxgh0st** and **GreenBot**. The activity reflects a broader shift in cloud-focused crime away from pure cryptomining and toward opportunistic abuse of smaller cloud services for fraud, spam, and account compromise.
Jun 29, 2026
Datadog Security Labs reported a targeted adversary-in-the-middle phishing campaign that impersonated the AWS sign-in experience to steal console credentials and capture MFA codes in real time, enabling attackers to hijack active sessions. The operation used at least three AWS-themed domains registered through **NICENIC INTERNATIONAL GROUP CO., LIMITED** and hosted behind **Cloudflare**, with cloned login pages and server-side logic that handled email, SMS, and authenticator-app MFA prompts. Phishing emails posing as **AWS Support** were sent through legitimate delivery services including **SendGrid** and **Nimbu** to improve deliverability and credibility. Researchers said the kit rendered pages only for pre-validated targets using an encrypted URL parameter, `input_24`, a gating method that likely tied each link to a specific victim and reduced exposure to sandboxes and scanners. Fewer than 50 target addresses were recovered, most tied to US-based software engineers and engineering leaders, and investigators also found a likely attacker validation batch file on VirusTotal. Datadog linked the infrastructure and tradecraft to a broader phishing-kit family previously used in campaigns impersonating **SendGrid**, **Salesforce**, and cryptocurrency wallet brands, indicating a reused and increasingly refined framework that defenders should track through suspicious DNS activity and anomalous **AWS CloudTrail** `ConsoleLogin` events.
Jul 12, 2026
Threat actors are increasingly improving phishing success rates by abusing *trusted* channels and infrastructure rather than relying on generic lures. One observed intrusion hijacked an active executive email thread via a compromised contractor account, allowing the attacker to reply inline with a link to a Microsoft 365 lookalike login flow; analysis of detonated samples indicated use of the **EvilProxy** adversary-in-the-middle phishkit, with layered anti-bot gating (e.g., Cloudflare Turnstile) and dynamic HTML/PDF content to capture credentials without exploiting software vulnerabilities. Separately, Rapid7 documented a cloud-abuse incident where attackers used **compromised AWS credentials** to stand up phishing/spam operations using **AWS WorkMail**, leveraging Amazon’s sender reputation and sidestepping typical **SES** anti-abuse controls while generating limited, service-native telemetry that can blend into normal administrative activity. A parallel, large-scale consumer fraud operation aligned with the **“PayTool”** ecosystem was reported targeting Canadian residents through SMS-driven lures (e.g., unpaid fines) that route victims through high-fidelity impersonations of the **Government of Canada**, **Air Canada**, and **Canada Post**, including province-selection workflows designed to mimic legitimate federal-to-provincial service handoffs before directing victims to localized scam domains. In contrast, LevelBlue SpiderLabs’ write-up is broader sector telemetry on education-targeted attacks (e.g., brute force `T1110`, credential dumping `T1003`, Kerberos ticket forgery `T1558`) and does not describe the same specific phishing/fraud campaigns, though it reinforces that credential theft remains a dominant initial access path across industries.
Jun 29, 2026