# input_24 AiTM Phishing Kit Harvesting AWS Console Credentials and Real-Time MFA Codes

> Datadog Security Research documented an adversary-in-the-middle (AiTM) phishing campaign using the "input_24" kit to clone the AWS Console sign-in page and capture credentials plus real-time MFA codes across email, SMS, and TOTP authenticator second factors. The campaign curated fewer than 50 mostly US-based software engineers and engineering leaders, and shares infrastructure and code lineage with prior SendGrid/Salesforce and Trezor/Ledger cryptocurrency-wallet phishing tied to the PoisonSeed kit.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0935
- **ID:** TL-2026-0935
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** PoisonSeed
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In mid-June 2026, Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign that clones the Amazon Web Services (AWS) Console sign-in page to harvest both root-user and IAM-user credentials together with real-time multi-factor authentication (MFA) codes. The operation is built on a phishing kit Datadog tracks as "input_24," named after the encrypted URL parameter that gates the kit.

The kit is engineered to defeat automated analysis. Each phishing link carries an `input_24` URL parameter containing an encrypted base64 blob that encodes the intended victim's email address. A single client-side JavaScript file (a React `Hi()` component) reads the parameter via `new URLSearchParams(window.location.search).get('input_24')`, extracts the blob, and POSTs it to `/api/check`. The server decrypts the blob, validates the victim, and sets a `validEmail` cookie (storing the plaintext victim email). A subsequent `/api/me` request returns the victim's email as JSON, and only then does the page render the cloned AWS login. Visitors without a valid encrypted identifier — sandboxes, scanners, researchers — never see the phishing content.

Once a victim submits credentials (via the root-user or IAM-user form) to `/api/login`, the kit operates as a true reverse-proxy / AiTM relay: it forwards the captured username and password to the genuine AWS authentication endpoint and parses AWS's response. The reply includes an MFA-type field (`sms`, `email`, or `gauth`) that drives conditional, server-side branching to the matching second-factor interface clone: an email-code prompt ("We sent an email with a verification code"), an SMS-code prompt ("We sent a text message with a verification code"), or a TOTP authenticator prompt ("Enter the code from your MFA device"). The victim's code is submitted to `/api/auth` alongside the stored credentials and AWS account ID, allowing the operator to replay it within the valid time window and complete authentication — defeating email, SMS, and app-based (TOTP) MFA.

Delivery abuses legitimate, reputable email infrastructure — SendGrid and the Nimbu platform — so messages pass SPF/DKIM/DMARC authentication and evade spam filtering. Targeting was curated rather than mass: fewer than 50 email addresses, predominantly US-based software engineers and engineering leadership, populations likely to hold privileged AWS access.

All observed domains were registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and fronted by Cloudflare, with registrations clustered between June 16 and June 19, 2026. AWS-themed domains (us-west-login[.]com, us-east-prod[.]com, loginportal-aws[.]com) run concurrently with SendGrid-impersonation domains (switch-sglogin[.]com, uslogin-prodsg[.]com, us-west-prod[.]com) that share the same registrar, hosting, and naming convention (us-west-prod / us-east-prod), indicating a single operator running parallel targeting vectors. On June 19, 2026 a validation/test batch file surfaced on VirusTotal: it pinged a non-existent placeholder domain (15hourolddomain-bypass-ed-google-workspaceprotection-fuckgoogle[.]com), ran curl commands against aws.us-west-login[.]com and a SendGrid-themed phishing URL, and queried WHOIS metadata — apparently an operator self-test of freshly stood-up infrastructure.

The code and tradecraft overlap strongly with the PoisonSeed phishing kit analyzed by NVISO Labs in August 2025: a React-based kit that impersonates SendGrid and other CRM/bulk-email services, appends an encrypted victim-email parameter to gate rendering, relays credentials to the impersonated service, and harvests the second factor (SMS / authenticator / email code or API key) plus session cookies. Earlier iterations of this lineage targeted cryptocurrency wallets (Trezor, Ledger) from July 2025 and impersonated Salesforce (dashboard-salesforce[.]com) in August 2025. The 2026 AWS campaign is a pivot of the same operator/kit toward cloud-console credential theft.

No CVE is involved — this is credential-phishing and MFA-relay tradecraft, not exploitation of a software vulnerability. Because the attack defeats all phishable MFA factors, the primary defensive recommendations are phishing-resistant MFA (FIDO2/WebAuthn security keys or passkeys) for privileged AWS principals, blocking the attacker infrastructure, and detecting anomalous ConsoleLogin events following contact with the phishing domains.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1586 Compromise Accounts
- T1598 Phishing for Information
- T1589 Gather Victim Identity Information
- T1566 Phishing
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1556 Modify Authentication Process
- T1497 Virtualization/Sandbox Evasion
- T1684.001 Impersonation
- T1078 Valid Accounts
- T1056 Input Capture
- T1078 Valid Accounts

## Sources

- [Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond](https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/)
- [Shedding light on the PoisonSeed phishing kit (NVISO Labs)](https://blog.nviso.eu/2025/08/12/shedding-light-on-poisonseeds-phishing-kit/)
- [PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials from Users and Organizations](https://gbhackers.com/poisonseed-phishing-kit-bypasses-mfa/)
- [PoisonSeed targets Mailchimp, Mailgun, and Zoho to phish high-value accounts (CSO Online)](https://www.csoonline.com/article/3956008/poisonseed-targets-mailchimp-mailgun-and-zoho-to-phish-high-value-accounts.html)
- [Email Threat Radar - September 2025 (Barracuda)](https://blog.barracuda.com/2025/09/23/email-threat-radar-september-2025)
- [MITRE ATT&CK T1621: Multi-Factor Authentication Request Generation / Interception](https://attack.mitre.org/techniques/T1621/)
- [AWS: Using multi-factor authentication (MFA) and FIDO security keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0935