AiTM Phishing Kit Stole AWS Console Credentials and MFA Codes

Datadog Security Labs reported a targeted adversary-in-the-middle phishing campaign that impersonated the AWS sign-in experience to steal console credentials and capture MFA codes in real time, enabling attackers to hijack active sessions. The operation used at least three AWS-themed domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted behind Cloudflare, with cloned login pages and server-side logic that handled email, SMS, and authenticator-app MFA prompts. Phishing emails posing as AWS Support were sent through legitimate delivery services including SendGrid and Nimbu to improve deliverability and credibility.

Researchers said the kit rendered pages only for pre-validated targets using an encrypted URL parameter, input_24, a gating method that likely tied each link to a specific victim and reduced exposure to sandboxes and scanners. Fewer than 50 target addresses were recovered, most tied to US-based software engineers and engineering leaders, and investigators also found a likely attacker validation batch file on VirusTotal. Datadog linked the infrastructure and tradecraft to a broader phishing-kit family previously used in campaigns impersonating SendGrid, Salesforce, and cryptocurrency wallet brands, indicating a reused and increasingly refined framework that defenders should track through suspicious DNS activity and anomalous AWS CloudTrail ConsoleLogin events.