AiTM Phishing Kit Targets AWS Console Credentials and MFA Codes
Summary
Datadog researchers analyzed targeted AWS phishing sites that cloned the sign-in page and used adversary-in-the-middle techniques to capture credentials and MFA codes. The kit shares traits with campaigns targeting SendGrid and other services.
Key points
- Three AWS-impersonating domains registered between June 16 and 18, 2026, hosted cloned AWS sign-in pages and used a server-driven flow for email, SMS, or authenticator-app MFA.
- The kit validated recipients using an encrypted email in the URL and rendered the phishing page only for a matching target.
- Researchers could not confirm the MFA relay end to end, but the code suggests credentials and second-factor codes may be forwarded to AWS in real time.
- A batch file found on VirusTotal contained a likely AWS Support phishing-email template; researchers did not observe the email in an actual inbox.
- Related SendGrid-impersonating domains shared technical traits with the AWS kit, which researchers linked to activity targeting other services since 2025.
- The researchers found fewer than 50 target email addresses in their sample, primarily associated with US-based software engineers and engineering leaders.
- Defenders should hunt for DNS activity to the listed phishing domains and review AWS CloudTrail ConsoleLogin events for possible credential replay.
Article Details
- Attack Vectors
- Targeted phishing emails impersonating AWS Support directed victims to cloned AWS console sign-in pages.
- The phishing pages used adversary-in-the-middle techniques to collect usernames, passwords, and MFA codes delivered by email, SMS, or authenticator app.
- The kit used recipient-specific encrypted email data in the URL and validated it before rendering the phishing page.
- Operators reportedly sent phishing emails through legitimate platforms such as SendGrid and Nimbu to improve deliverability.
- Defensive Notes
- Hunt for DNS activity to the listed phishing domains and review AWS CloudTrail for ConsoleLogin events.
- Datadog recommends its Cloud SIEM detections for AWS ConsoleLogin with MFA and without MFA in Impossible Travel scenarios.
- A ConsoleLogin event following activity to these domains may indicate captured credentials were replayed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 15hourolddomain-bypass-ed-google-workspaceprotection-fuckgoogle[.]com | Domain referenced by an alleged attacker validation batch file; the article says it did not exist. |
| DOMAIN | dashboard-salesforce[.]com | Domain reported to have impersonated a Salesforce login page using the same phishing-kit gating function. |
| DOMAIN | loginportal-aws[.]com | Phishing domain impersonating the AWS console sign-in page. |
| DOMAIN | switch-sglogin[.]com | Domain impersonating SendGrid, associated with the related phishing-kit activity. |
| DOMAIN | us-east-prod[.]com | Phishing domain impersonating the AWS console sign-in page. |
| DOMAIN | us-west-login[.]com | Phishing domain impersonating the AWS console sign-in page. |
| DOMAIN | us-west-prod[.]com | Domain impersonating SendGrid, associated with the related phishing-kit activity. |
| DOMAIN | uslogin-prodsg[.]com | Domain impersonating SendGrid, associated with the related phishing-kit activity. |
| HOSTNAME | aws-central[.]us-west-login[.]com | Phishing hostname used by the AWS credential-harvesting kit. |
| HOSTNAME | aws[.]us-east-prod[.]com | Phishing hostname used by the AWS credential-harvesting kit. |
| HOSTNAME | aws[.]us-west-login[.]com | Phishing hostname used by the AWS credential-harvesting kit. |
| HOSTNAME | sendgrid[.]us-west-prod[.]com | Phishing hostname associated with the SendGrid-impersonating kit. |
| HOSTNAME | sendgrid[.]uslogin-prodsg[.]com | Phishing hostname associated with the SendGrid-impersonating kit. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing pages collected victims' AWS usernames and passwords through cloned login forms.T1111 · Multi-Factor Authentication InterceptionThe kit captured MFA codes delivered by email, SMS, or authenticator app.T1557 · Adversary-in-the-MiddleThe kit used an adversary-in-the-middle flow to capture MFA codes in real time; the article says credential relaying to AWS could not be confirmed.T1566.002 · Spearphishing LinkThe campaign used phishing emails impersonating AWS Support to direct targeted recipients to cloned sign-in pages.
Vendors
Products
AWSBetween June 16 and 19, 2026, Datadog Security Research observed a wave of AWS console phishing sites attempting to harvest victim credentials.CloudflareThree domains, registered within the same 48-hour window and hosted on Cloudflare, impersonating the AWS login page and used adversary-in-the-middle (AiTM) techniques to capture multi-factor authentication (MFA) codesLedgerA version of the input_24 kit has been active since July 2025, primarily targeting cryptocurrency wallets such as Trezor and Ledger.NimbuThe operators sent phishing emails through legitimate platforms such as SendGrid and Nimbu to pass email authentication checks, a standard technique to improve deliverability and avoid spam filters.SalesforceIn August 2025, the domain dashboard-salesforce[.]com impersonated a Salesforce login page using the same gating function, which links it to the same kit.SendGridran several curl commands against aws.us-west-login[.]com and a SendGrid URL that resolved to the phishing domain, and queried WHOIS metadata for aws.us-west-login[.]com.TrezorA version of the input_24 kit has been active since July 2025, primarily targeting cryptocurrency wallets such as Trezor and Ledger.