Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond

Between June 16 and 19, 2026, a phishing campaign targeted AWS users using adversary-in-the-middle (AiTM) techniques to steal console credentials and multi-factor authentication (MFA) codes in real time. The attackers used domains impersonating AWS and SendGrid, hosted on Cloudflare, and delivered phishing emails through legitimate platforms like SendGrid to improve deliverability. The campaign employed a targeted approach with personalized URLs containing encrypted email identifiers, primarily aimed at US-based software engineers and engineering leadership.

AI-extracted · verify before operational use