InfoSecBulletin Cybersecurity for mankind
A complex phishing attack targets AWS console users by misusing Cloudflare-hosted websites to steal login details. Each domain had a nearly identical copy of the AWS login page. It used a server-driven process that switched to email, SMS, or authenticator-app MFA challenges, allowing for real-time collection of second factors.
The phishing kit used a gating mechanism that validates the visitor before rendering the page. A URL parameter named input_24 carried an encrypted base64 blob that the kit POSTed to /api/check; the server decrypted it to identify the target email and set a cookie (observed as validEmail).
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Subsequent /api/me calls got a JSON object with the victim’s address and decided if to show the clone or a blank page. This block stops sandboxes and many researchers from easily checking the site, showing it is a targeted delivery and not random mass phishing.
Credential stealing was centralized with one JavaScript file. After victims entered their details at /api/login, the kit read the server’s JSON reply and took the victim to /email, /sms, or /gauth based on the MFA type given. Each route showed a convincing challenge screen that matched AWS’s text and labels.
The kit then forwarded collected credentials and MFA codes to /api/auth; the server again selected the next route.
The code structure suggests the kit can relay authentication attempts to the legitimate AWS login in real time and return the resulting responses to the victim, classic AiTM behavior that permits capture and immediate reuse of MFA codes.
Between June 16 and 19, 2026, Datadog Security Research observed a wave of AWS console phishing sites attempting to harvest victim credentials.
The following three domains were registered between June 16 and 18, 2026, all through the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED.
| Domains | Subdomains | Registration date | Registrar |
|---|---|---|---|
| us-west-login[.]com | aws.us-west-login[.]com, aws-central.us-west-login[.]com | June 18, 2026 | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| us-east-prod[.]com | aws.us-east-prod[.]com | June 17, 2026 | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| loginportal-aws[.]com | June 16, 2026 | NICENIC INTERNATIONAL GROUP CO., LIMITED |
Cloudflare-Hosted AWS Phishing
Datadog researchers also found likely delivery artifacts on VirusTotal: a June 19 batch file referencing aws.us-west-login[.]com that executed curl commands against the phishing domain and a SendGrid URL, queried WHOIS metadata, and included the structure of a forged AWS Support email referencing a fabricated support ticket.
The operators used legitimate email delivery platforms such as SendGrid and Nimbu to bypass SPF/DKIM/DMARC checks and improve deliverability an increasingly common tactic among prolific phishing kits.
Possible rendering of the alleged phishing email on Virustotal (Source : Datadog).
The investigation found three domains pretending to be SendGrid. These were registered around the same time and were hosted on Cloudflare. They used the same React SPA design, encrypted email checks, and strong MFA management. This connects the campaign to a phishing kit based on input_24 that has been active since at least July 2025.
Prior studies (NVISO Labs, August 2025) saw the same actions on CRM and crypto-logins, showing that the same setup is likely being used for important AWS targets.
Defenders should look for DNS and network signs linked to the identified domains. They should also treat any ConsoleLogin CloudTrail events that come after as very important.
Datadog suggests checking queries for DNS activity and CloudTrail ConsoleLogin events. If there is a ConsoleLogin event after DNS or HTTP access to these phishing domains, it likely means credentials were stolen and might be reused.
Datadog Cloud SIEM ships detection rules that flag ConsoleLogin anomalies such as Impossible Travel with or without MFA; pairing network telemetry with CloudTrail makes these detections actionable.
Block and watch the listed domains, check CloudTrail ConsoleLogin events, and tell privileged AWS users to use phishing-resistant FIDO2 keys and access rules that reduce risks of credential replay.
