PoisonSeeds AiTM AWS MFA Relay — Multi-IP Sequential MFA Challenges

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•7

Detects anomalous authentication behavior consistent with an Adversary-in-the-Middle (AiTM) attack, where a single user account triggers multiple MFA challenge requests from distinct source IP addresses within a two-minute window. This behavior is indicative of an adversary proxying authentication requests in real-time between the user and a legitimate service.