Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Hackers Use Cloned AWS Console Login Pages to Capture MFA Codes and Replay Credentials
Excerpt
Between June 16 and 19, 2026, Datadog Security Research uncovered a highly targeted phishing campaign aimed at Amazon Web Services (AWS) users. Threat actors deployed sophisticated adversary-in-the-middle (AiTM) techniques to steal login credentials and capture multi-factor authentication (MFA) codes in real time. The attackers targeted a curated list of fewer than 50 individuals, primarily software engineers based in the United States, utilizing delivery methods designed to…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | aws-central.us-west-login.com | High | Score 58/100 | First seen |
| Domain | aws.us-west-login.com | High | Score 58/100 | First seen |
| Domain | aws.us-east-prod.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…