Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond

Reported 25 Jun 2026 by otx · Severity: medium

Between June 16 and 19, 2026, a sophisticated adversary-in-the-middle phishing campaign targeted AWS console users through three domains registered within 48 hours and hosted on Cloudflare. The campaign impersonated AWS login pages and captured credentials along with real-time mu