AWS Console Alert: Real-Time “AiTM” Phishing Campaign Bypasses MFA with Rapid Precision

Datadog Security Research identified an active AiTM phishing campaign that clones the AWS Management Console and proxies authentication to capture credentials and MFA codes in real time, using typosquatted domains (e.g., cloud-recovery.net, cloud-policy.com) and legitimate CloudFront assets. The operation enables rapid account takeover (observed compromises within ~20 minutes); recommended mitigations include enforcing FIDO2/WebAuthn, monitoring egress to the listed domains, and navigating to the AWS Console via trusted bookmarks.