Wiz Traces AWS Credential-Phishing Campaign Through Redirects and Related Domains

Aug 8, 2024 · Original article ↗

Summary

Wiz investigated an AWS credential-phishing email, traced its redirect chain to a fake sign-in page, and identified related domains through historical DNS and lookalike searches. The attacker’s intent and infrastructure links remain partly unconfirmed.

Key points

The phishing email contained an image that led through redirects to a PDF and then to a fake AWS sign-in page at signin[.]aws[.]consoleportal[.]tech.
The fake login page mimicked AWS and loaded JavaScript from d35uxhjf90umnp[.]cloudfront[.]net; Wiz could not confirm whether the script or hosting subscription was linked to the attacker.
The phishing page rejected test credentials unless the originally intended victim’s email address was entered. The infrastructure was taken down before Wiz could investigate further.
Wiz used historical DNS data to identify two former IP addresses for consoleportal[.]tech and found three other domains sharing those addresses that appeared to be used for AWS phishing.
Wiz identified additional domains mimicking AWS sign-in pages, but said they were not necessarily operated by the same actor and their malicious use was not confirmed.
Wiz recommends disabling AWS root logins where possible, using phishing-resistant FIDO security keys for management accounts, using SSO, limiting privileges, and enabling CloudTrail logging.

Article Details

Attack Vectors: A phishing email sent to a personal inbox used a PNG image that linked through redirects to a PDF viewer and then to a cloned AWS sign-in page to harvest credentials.
The phishing page required the originally intended victim’s email address; attempts with other addresses returned a 400 error.
Defensive Notes: Disable AWS account root logins through an SCP where possible; protect AWS Organization Management account root logins with phishing-resistant MFA such as FIDO security keys.
Use SSO instead of IAM users or root logins, and apply least privilege with access to critical accounts restricted to a minimal set of employees.
Enable Amazon CloudTrail to assess the impact and scope of compromised credentials.
Do not rely solely on browser phishing detection to protect users.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`docshare[.]tech`	Domain identified by shared historical IP resolution and described as appearing to be used for AWS phishing.
DOMAIN	`officequalcomm[.]com`	Domain identified by shared historical IP resolution and described as appearing to be used for AWS phishing.
DOMAIN	`webportal[.]tech`	Domain identified by shared historical IP resolution and described as appearing to be used for AWS phishing.
EMAIL	`admin@alchemistdigital[.]ae`	Sender address on the phishing email; the article says its domain is listed in open-source threat intelligence as known for distributing malware.
HOSTNAME	`signin[.]aws[.]aathenahealth[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]amaonz[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]amzan[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]athenahelath[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]bashaws[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]clouddocuments[.]app`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]dev-login[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]factorydirectwork[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]hashcrp[.]in`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]kintsuma[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]lustforkangaroos[.]top`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]mantrapays[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]offlce[.]in`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]onlinelogin-link[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]onmicrosofte[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]portalunos[.]org`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]registeringencrypted[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]safelinks-protection[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]sharedpoint[.]online`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
HOSTNAME	`signin[.]aws[.]spaceigniter[.]com`	Lookalike AWS sign-in hostname the article says is likely to be used in phishing.
IPV4	`162[.]0[.]216[.]98`	Historical IP resolution for the phishing domain consoleportal[.]tech.
IPV4	`185[.]170[.]198[.]250`	Historical IP resolution for the phishing domain consoleportal[.]tech.
URL	`hxxps[:]//cli[.]re/j9PQ88`	Link in the PDF that started the redirect chain to the credential-harvesting page.
URL	`hxxps[:]//console[.]aws[.]consoleportal[.]tech/IgXlrDYW`	Attacker-controlled redirect destination in the phishing chain.
URL	`hxxps[:]//giraffe-viola-p262[.]squarespace[.]com/`	Initial link destination in the phishing email’s redirect chain.
URL	`hxxps[:]//signin[.]aws[.]consoleportal[.]tech/signin`	Credential-harvesting page that cloned the AWS sign-in page.

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe cloned AWS sign-in page collected credentials and required the originally intended victim’s email address.T1566.002 · Spearphishing LinkThe phishing email included an image link that led through redirects to the credential-harvesting page.

Products

AWSreceived a phishing email to their personal inbox that attempted to lure them into providing their AWS login credentials. While the employee immediately recognized this as a phishing email, and we do not AWS CloudTrailCloud logging services such as Amazon CloudTrail should always be enabled. They are an essential tool for assessing the impact of compromised credentials within cloud environments. They allow security teams to identify