Loading story…
Wiz documented Console Conceal, a technique in which an attacker with stolen IAM-user credentials and permission to call AssumeRole selects an arbitrary role-session name and creates a federated AWS Management Console session. CloudTrail records subsequent console activity under a derived temporary access key rather than the access key issued in the initiating AssumeRole event, frustrating direct access-key correlation between the activity and the compromised IAM principal.
AWS organizations should require and monitor SourceIdentity on role assumptions, as it propagates an administrator-controlled, immutable identity into subsequent CloudTrail events. For historical sessions without SourceIdentity, investigators can correlate suspicious console events to role assumptions using the role name, role-session name, and session-creation timing, while reviewing CloudTrail userIdentity fields and tightening IAM permissions that permit role assumption and custom identity-broker console access.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Wiz described Console Conceal, in which an attacker with compromised IAM credentials can assume a role using a misleading session name and create a federated AWS Console session. CloudTrail logs console activity under a temporary access key that differs from the key in the initiating AssumeRole event, impeding direct attribution; SourceIdentity can preserve attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
docs.aws.amazon.com
Open sourcewiz.io
Open sourcedocs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and cloud security vendors documented a recurring AWS IAM trust policy flaw in OIDC integrations for **Terraform Cloud** and **GitHub Actions** that can let unauthorized external workloads assume customer roles. In both cases, the issue stems from missing or overly broad `sub` conditions in resource-based trust policies: older AWS-created Terraform Cloud policies could omit `app.terraform.io:sub`, and GitHub Actions deployments often lacked the repository-specific `sub` restriction. That weakness meant any valid identity token from the trusted OIDC provider could potentially satisfy the role trust and gain access to the victim AWS account. Public writeups showed how attackers could exploit broad Terraform Cloud patterns by creating a matching organization, project, and workspace, then using Terraform to provision a backdoored IAM role with **`AdministratorAccess`**. The GitHub Actions variant was amplified by copied example code and Terraform JSON duplicate-key behavior, prompting coordinated disclosures by researchers, Wiz, Datadog, AWS, and HashiCorp. AWS updated its console behavior, notified affected customers, blocked creation of some new misconfigured policies, and set enforcement deadlines, while defenders were urged to audit OIDC trust relationships, require precise subject claims, and use controls such as **Resource Control Policies** and detection rules to prevent arbitrary role assumption.
Sep 3, 2026
Datadog Security Labs reported an active **adversary-in-the-middle (AiTM)** phishing campaign targeting **AWS Management Console** users with high-fidelity cloned login pages hosted on **typosquatted domains**. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to **validate credentials** and capture **session material** (and likely **MFA/OTP codes**) before redirecting victims, enabling rapid post-compromise access to cloud environments. In an observed case, the threat actor accessed a compromised AWS account **within ~20 minutes** of credential submission, with console access originating from `185.209.196.132` (identified as a **Mullvad VPN** egress). Datadog identified **two active infrastructure clusters** and a third related domain, including `cloud-recovery[.]net` (IP `178.16.54[.]142`), `cloud-policy[.]com` (IP `69.67.172[.]30`), and `cloud-recovery[.]us`, with shared registrar metadata (Registrar ID **3254**, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is **credential theft** rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender `noreply@security[.]aws`.
Jun 29, 2026
Palo Alto Networks Unit 42 presented a method for identifying the functional roles of AWS cloud identities from **AWS CloudTrail** activity rather than IAM permissions or naming conventions. Across more than 40,000 identities in 125 cloud environments observed over two months, the researchers found repeatable behavioral groups representing administrators, DevOps teams, CI/CD systems, security tools, backup agents, networking components, and FinOps platforms. The pipeline transforms invoked AWS API operations into sparse Boolean vectors, uses UMAP for dimensionality reduction, and applies HDBSCAN to group identities and surface outliers. One administrator-console cluster contained roughly 5,000 identities, about 94% of which used `ConsoleLogin`, versus under 1% in other clusters; Unit 42 proposes converting selected clusters into sparse L1-regularized logistic-regression classifiers deployable in SQL to flag deviations such as a backup identity executing administrative actions.
Sep 14, 2026