input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes — Threadlinqs Intelligence
As of 2026-06-24, input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes is a high-severity phishing threat attributed to PoisonSeed, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0935 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: PoisonSeed · FINANCIAL
Datadog Security Research documented an adversary-in-the-middle (AiTM) phishing campaign using the "input_24" kit to clone the AWS Console sign-in page and capture credentials plus real-time MFA codes
In mid-June 2026, Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign that clones the Amazon Web Services (AWS) Console sign-in page to harvest both root-user and IAM-user credentials together with real-time multi-factor authentication (MFA) codes. The operation is built on a phishing kit Datadog tracks as "input_24," named after the encrypted URL parameter that gates the kit.
The kit is engineered to defeat automated analysis. Each phishing link carries an `input_24` URL parameter containing an encrypted base64 blob that encodes the intended victim's email address. A single client-side JavaScript file (a React `Hi()` component) reads the parameter via `new URLSearchParams(window.location.search).get('input_24')`, extracts the blob, and POSTs it to `/api/check`. The server decrypts the blob, validates the victim, and sets a `validEmail` cookie (storing the plaintext victim email). A subsequent `/api/me` request returns the victim's email as JSON, and only then does the page render the cloned AWS login. Visitors without a valid encrypted identifier — sandboxes, scanners, researchers — never see the phishing content.
Once a victim submits credentials (via the root-user or IAM-user form) to `/api/login`, the kit operates as a true reverse-proxy / AiTM relay: it forwards the captured username and password to the genuine AWS authentication endpoint and parses AWS's response. The reply includes an MFA-type field (`sms`, `email`, or `gauth`) that drives conditional, server-side branching to the matching second-factor interface clone: an email-code prompt ("We sent an email with a verification code"), an SMS-code prompt ("We sent a text message with a verification code"), or a TOTP authenticator prompt ("Enter the code from your MFA device"). The victim's code is submitted to `/api/auth` alongside the stored credentials and AWS account ID, allowing the operator to replay it within the valid time window and complete authentication — defeating email, SMS, and app-based (TOTP) MFA.
Delivery abuses legitimate, reputable email infrastructure — SendGrid and the Nimbu platform — so messages pass SPF/DKIM/DMARC authentication and evade spam filtering. Targeting was curated rather than mass: fewer than 50 email addresses, predominantly US-based software engineers and engineering leadership, populations likely to hold privileged AWS access.
All observed domains were registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and fronted by Cloudflare, with registrations clustered between June 16 and June 19, 2026. AWS-themed domains (us-west-login[.]com, us-east-prod[.]com, loginportal-aws[.]com) run concurrently with SendGrid-impersonation domains (switch-sglogin[.]com, uslogin-prodsg[.]com, us-west-prod[.]com) that share the same registrar, hosting, and naming convention (us-west-prod / us-east-prod), indicating a single operator running parallel targeting vectors. On June 19, 2026 a validation/test batch file surfaced on VirusTotal: it pinged a non-existent placeholder domain (15hourolddomain-bypass-ed-google-workspaceprotection-fuckgoogle[.]com), ran curl commands against aws.us-west-login[.]com and a SendGrid-themed phishing URL, and queried WHOIS metadata — apparently an operator self-test of freshly stood-up infrastructure.
The code and tradecraft overlap strongly with the PoisonSeed phishing kit analyzed by NVISO Labs in August 2025: a React-based kit that impersonates SendGrid and other CRM/bulk-email services, appends an encrypted victim-email parameter to gate rendering, relays credentials to the impersonated service, and harvests the second factor (SMS / authenticator / email code or API key) plus session cookies. Earlier iterations of this lineage targeted cryptocurrency wallets (Trezor, Ledger) from July 2025 and impersonated Salesforce (dashboard-salesforce[.]com) in August 2025. The 2026 AWS campaign is a pivot of the same operator/kit toward cloud-console credential theft.
No CV
Weaknesses (CWE)
CWE-1021, CWE-290, CWE-308, CWE-522, CWE-836
Target sectors: technology, software, engineering, cloud-services
Target regions: North America, United States
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583, T1583, T1587, T1608, T1586, T1598, T1589, T1566, T1621, T1056