Attackers are expanding access through Amazon Cognito

Expel observed attackers exploiting misconfigured Amazon Cognito deployments that exposed identity pool IDs and allowed token-exchange for temporary AWS credentials, enabling direct CLI/programmatic access to the AWS control plane; the report describes the attack flow, SOC findings (hundreds of API calls, attempts across ~50 services, many AccessDenied responses), detection indicators (Cognito-assumed role names, ASIA access key prefixes, unusual User-Agent values), and mitigations (harden Cognito IAM policies and avoid exposing identity pool IDs).