PoisonSeeds AiTM AWS ConsoleLogin Followed by Rapid Session Replay

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•7

Detects anomalous AWS API activity immediately following a successful ConsoleLogin event for the same user. This behavior is indicative of a session replay attack, often associated with AiTM phishing kits like PoisonSeeds, where a victim's session cookie is harvested and immediately reused by an attacker to programmatically access the AWS environment.