Loading story…
Datadog Security Labs reported a targeted adversary-in-the-middle phishing campaign that impersonated the AWS sign-in experience to steal console credentials and capture MFA codes in real time, enabling attackers to hijack active sessions. The operation used at least three AWS-themed domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted behind Cloudflare, with cloned login pages and server-side logic that handled email, SMS, and authenticator-app MFA prompts. Phishing emails posing as AWS Support were sent through legitimate delivery services including SendGrid and Nimbu to improve deliverability and credibility.
Researchers said the kit rendered pages only for pre-validated targets using an encrypted URL parameter, input_24, a gating method that likely tied each link to a specific victim and reduced exposure to sandboxes and scanners. Fewer than 50 target addresses were recovered, most tied to US-based software engineers and engineering leaders, and investigators also found a likely attacker validation batch file on VirusTotal. Datadog linked the infrastructure and tradecraft to a broader phishing-kit family previously used in campaigns impersonating SendGrid, Salesforce, and cryptocurrency wallet brands, indicating a reused and increasingly refined framework that defenders should track through suspicious DNS activity and anomalous AWS CloudTrail ConsoleLogin events.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Datadog disclosed that the phishing kit used cloned AWS sign-in pages, relayed victim logins to the legitimate AWS flow, and gated page rendering with an encrypted URL parameter to restrict access to pre-validated targets. The report also noted phishing delivery through legitimate services such as SendGrid and Nimbu and identified fewer than 50 recovered target addresses.
Researchers identified at least three AWS-themed phishing domains registered within a 48-hour window through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on Cloudflare as part of the campaign infrastructure.
Datadog Security Research observed a targeted adversary-in-the-middle phishing campaign against AWS users that harvested console credentials and captured MFA codes in real time. The activity was observed between June 16 and 19, 2026, and targeted primarily US-based engineering personnel.
Datadog linked the AWS-themed infrastructure and tradecraft to a broader phishing kit family that had previously impersonated brands such as SendGrid, Salesforce, and cryptocurrency wallets since at least July 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcesecuritylabs.datadoghq.com
Open sourcedocs.datadoghq.com
Open sourcedocs.datadoghq.com
Open sourceblog.nviso.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Datadog Security Labs reported an active **adversary-in-the-middle (AiTM)** phishing campaign targeting **AWS Management Console** users with high-fidelity cloned login pages hosted on **typosquatted domains**. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to **validate credentials** and capture **session material** (and likely **MFA/OTP codes**) before redirecting victims, enabling rapid post-compromise access to cloud environments. In an observed case, the threat actor accessed a compromised AWS account **within ~20 minutes** of credential submission, with console access originating from `185.209.196.132` (identified as a **Mullvad VPN** egress). Datadog identified **two active infrastructure clusters** and a third related domain, including `cloud-recovery[.]net` (IP `178.16.54[.]142`), `cloud-policy[.]com` (IP `69.67.172[.]30`), and `cloud-recovery[.]us`, with shared registrar metadata (Registrar ID **3254**, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is **credential theft** rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender `noreply@security[.]aws`.
Jun 29, 2026
Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (**SES**) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (**IAM**) access keys discovered in public GitHub repositories, `.env` files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass **SPF**, **DKIM**, and **DMARC**, reducing the effectiveness of reputation-based filtering. Observed campaigns included fake **DocuSign** notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to **AWS Trust & Safety**.
Jun 29, 2026
Threat researchers reported an ongoing credential-harvesting operation attributed to the **Tycoon 2FA** phishing kit, repeatedly leveraging newly registered `*.contractors` domains to host convincing Gmail and Microsoft 365/Outlook login lures. Observed pretexts include ICANN-related “email verification,” document-sharing prompts, and account-security warnings, with consistent infrastructure and execution flow across waves of activity. Technical analysis of the phishing HTML/JavaScript and runtime behavior indicates **MFA-aware** logic and extensive **anti-analysis** tradecraft typical of Tycoon 2FA, including developer-tools and sandbox/analysis-environment detection, debugger timing checks, and forced redirects/termination when inspection is detected. The campaign’s use of obfuscation and encrypted runtime loaders is intended to hinder static and dynamic analysis while enabling real-time credential capture against enterprise email identities.
Jun 29, 2026