input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes
input_24 AiTM Phishing Kit Harvesting AWS Console (TL-2026-0935), also tracked as Behind the Console AWS AiTM campaign, is a high-severity phishing campaign, first published 2026-06-24. It is attributed to PoisonSeed with medium confidence, affects Amazon Web Services AWS Management Console (sign-in / root and IAM, maps to 15 MITRE ATT&CK techniques (T1056, T1078, T1497), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0935
- Threat ID
- TL-2026-0935
- Also known as
- Behind the Console AWS AiTM campaign, input_24 AWS phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution
- PoisonSeed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software, engineering, cloud-services
- Target regions
- North America, United States
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in input_24 AiTM Phishing Kit Harvesting AWS Console
Malware and tooling: input_24 phishing kit (PoisonSeed)
Datadog Security Research documented an adversary-in-the-middle (AiTM) phishing campaign using the "input_24" kit to clone the AWS Console sign-in page and capture credentials plus real-time MFA codes across email, SMS, and TOTP authenticator second factors. The campaign curated fewer than 50 mostly US-based software engineers and engineering leaders, and shares infrastructure and code lineage with prior SendGrid/Salesforce and Trezor/Ledger cryptocurrency-wallet phishing tied to the PoisonSeed kit.
How input_24 AiTM Phishing Kit Harvesting AWS Console works
In mid-June 2026, Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign that clones the Amazon Web Services (AWS) Console sign-in page to harvest both root-user and IAM-user credentials together with real-time multi-factor authentication (MFA) codes. The operation is built on a phishing kit Datadog tracks as "input_24," named after the encrypted URL parameter that gates the kit.
The kit is engineered to defeat automated analysis. Each phishing link carries an `input_24` URL parameter containing an encrypted base64 blob that encodes the intended victim's email address. A single client-side JavaScript file (a React `Hi()` component) reads the parameter via `new URLSearchParams(window.location.search).get('input_24')`, extracts the blob, and POSTs it to `/api/check`. The server decrypts the blob, validates the victim, and sets a `validEmail` cookie (storing the plaintext victim email). A subsequent `/api/me` request returns the victim's email as JSON, and only then does the page render the cloned AWS login. Visitors without a valid encrypted identifier — sandboxes, scanners, researchers — never see the phishing content.
Once a victim submits credentials (via the root-user or IAM-user form) to `/api/login`, the kit operates as a true reverse-proxy / AiTM relay: it forwards the captured username and password to the genuine AWS authentication endpoint and parses AWS's response. The reply includes an MFA-type field (`sms`, `email`, or `gauth`) that drives conditional, server-side branching to the matching second-factor interface clone: an email-code prompt ("We sent an email with a verification code"), an SMS-code prompt ("We sent a text message with a verification code"), or a TOTP authenticator prompt ("Enter the code from your MFA device"). The victim's code is submitted to `/api/auth` alongside the stored credentials and AWS account ID, allowing the operator to replay it within the valid time window and complete authentication — defeating email, SMS, and app-based (TOTP) MFA.
Delivery abuses legitimate, reputable email infrastructure — SendGrid and the Nimbu platform — so messages pass SPF/DKIM/DMARC authentication and evade spam filtering. Targeting was curated rather than mass: fewer than 50 email addresses, predominantly US-based software engineers and engineering leadership, populations likely to hold privileged AWS access.
All observed domains were registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and fronted by Cloudflare, with registrations clustered between June 16 and June 19, 2026. AWS-themed domains (us-west-login[.]com, us-east-prod[.]com, loginportal-aws[.]com) run concurrently with SendGrid-impersonation domains (switch-sglogin[.]com, uslogin-prodsg[.]com, us-west-prod[.]com) that share the same registrar, hosting, and naming convention (us-west-prod / us-east-prod), indicating a single operator running parallel targeting vectors. On June 19, 2026 a validation/test batch file surfaced on VirusTotal: it pinged a non-existent placeholder domain (15hourolddomain-bypass-ed-google-workspaceprotection-fuckgoogle[.]com), ran curl commands against aws.us-west-login[.]com and a SendGrid-themed phishing URL, and queried WHOIS metadata — apparently an operator self-test of freshly stood-up infrastructure.
The code and tradecraft overlap strongly with the PoisonSeed phishing kit analyzed by NVISO Labs in August 2025: a React-based kit that impersonates SendGrid and other CRM/bulk-email services, appends an encrypted victim-email parameter to gate rendering, relays credentials to the impersonated service, and harvests the second factor (SMS / authenticator / email code or API key) plus session cookies. Earlier iterations of this lineage targeted cryptocurrency wallets (Trezor, Ledger) from July 2025 and impersonated Salesforce (dashboard-salesforce[.]com) in August 2025. The 2026 AWS campaign is a pivot of the same operator/kit toward cloud-console credential theft.
No CVE is involved — this is credential-phishing and MFA-relay tradecraft, not exploitation of a software vulnerability. Because the attack defeats all phishable MFA factors, the primary defensive recommendations are phishing-resistant MFA (FIDO2/WebAuthn security keys or passkeys) for privileged AWS principals, blocking the attacker infrastructure, and detecting anomalous ConsoleLogin events following contact with the phishing domains.
MITRE ATT&CK techniques used in TL-2026-0935
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1621 Multi-Factor Authentication Request Generation
Collection
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
Defense Evasion
T1497 Virtualization/Sandbox Evasion
defense-impairment
T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
stealth
Affected products and versions in input_24 AiTM Phishing Kit Harvesting AWS Console
- Amazon Web Services — AWS Management Console (sign-in / root and IAM authentication)
Vulnerable versions: all accounts using phishable MFA (SMS, email, TOTP)
Fixed in: accounts enforcing FIDO2/WebAuthn phishing-resistant MFA - Twilio — SendGrid (email delivery abused for authenticated delivery and impersonated)
Vulnerable versions: N/A - service abuse - Nimbu — Nimbu email/CRM platform (abused for authenticated delivery)
Vulnerable versions: N/A - service abuse
Remediation for input_24 AiTM Phishing Kit Harvesting AWS Console
Immediate actions
- Block all listed attacker domains and subdomains at DNS, secure web gateway, and email gateway (us-west-login[.]com, us-east-prod[.]com, loginportal-aws[.]com, switch-sglogin[.]com, uslogin-prodsg[.]com, us-west-prod[.]com and subdomains)
- Hunt CloudTrail for ConsoleLogin events from curated engineering personnel, especially following DNS resolution of the phishing domains
- Force credential and MFA reset for any user who interacted with the phishing links; invalidate active AWS console sessions
- Alert on AWS ConsoleLogin with/without MFA that triggers impossible-travel or new-ASN/new-geo conditions
Workarounds
- Require IAM Identity Center / SSO with conditional access and device trust instead of static console credentials
- Restrict console access by IP allowlist / VPN where feasible
Longer-term hardening
- Mandate phishing-resistant MFA (FIDO2/WebAuthn hardware security keys or passkeys) for all root and IAM principals, prioritizing privileged and C-level accounts
- Eliminate SMS, voice, and email-code MFA methods for AWS access
- Deploy DNS filtering / newly-registered-domain blocking and brand-impersonation monitoring for AWS, SendGrid, and Salesforce lookalikes
- Enforce least privilege, avoid daily use of the root account, and enable organization-wide CloudTrail and Cloud SIEM detections
Weaknesses (CWE) in input_24 AiTM Phishing Kit Harvesting AWS Console
CWE-1021, CWE-290, CWE-308, CWE-522, CWE-836
Timeline of input_24 AiTM Phishing Kit Harvesting AWS Console
- input_24 / PoisonSeed lineage active targeting cryptocurrency wallet users (Trezor, Ledger) with the same email-gating phishing kit.
- NVISO Labs publishes analysis of the PoisonSeed phishing kit: React-based, impersonates SendGrid and other CRM/bulk-email services, encrypted victim-email gating, relays credentials and harvests SMS/authenticator/email second factors plus session cookies.
- Same kit lineage observed impersonating Salesforce via dashboard-salesforce[.]com using identical victim-gating mechanics.
- loginportal-aws[.]com registered via NICENIC and fronted by Cloudflare — first of the June 2026 AWS-campaign domains.
- us-east-prod[.]com and uslogin-prodsg[.]com (SendGrid variant) registered.
- us-west-login[.]com and us-west-prod[.]com (SendGrid variant) registered.
- switch-sglogin[.]com registered; an operator validation/test batch file pinging the phishing domains and a placeholder domain surfaces on VirusTotal.
- Datadog Security Research publishes 'Behind the console,' documenting the input_24 AWS AiTM campaign, curated targeting of <50 US engineering personnel, and PoisonSeed infrastructure/code overlap.
Sources cited for input_24 AiTM Phishing Kit Harvesting AWS Console
- Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond
- Shedding light on the PoisonSeed phishing kit (NVISO Labs)
- PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials from Users and Organizations
- PoisonSeed targets Mailchimp, Mailgun, and Zoho to phish high-value accounts (CSO Online)
- Email Threat Radar - September 2025 (Barracuda)
- MITRE ATT&CK T1621: Multi-Factor Authentication Request Generation / Interception
- AWS: Using multi-factor authentication (MFA) and FIDO security keys
Threats related to input_24 AiTM Phishing Kit Harvesting AWS Console
- Bluekit Phishing-as-a-Service Bypasses Microsoft MFA via Browser-in-the-Middle (rrweb DOM Streaming)
- Multi-Stage 'Code of Conduct' Phishing Campaign Leads to AiTM Token Compromise (Microsoft Defender Research, April 2026)
- Zscaler ThreatLabz 2026 Phishing Report: Volume Falls 20% as AI Trades Mass Spam for Targeted, Higher-Conversion Credential & Session-Theft Campaigns
- Kali365 (K365) PhaaS Expansion — OAuth Device-Code Token Theft Beyond M365 to Okta SSO, AWS, Xerox DocuShare & MAX Messenger (126-Host Cluster, Live C2 Panel)
- AWS CLI Login Phishing: Abusing `aws login --remote` Cross-Device Authentication to Steal Console/CLI Sessions
Detection coverage for TL-2026-0935
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0935 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.