PoisonSeeds AiTM AWS Session Token Replay — ConsoleLogin IP vs API Call IP Mismatch

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•6

Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.