PoisonSeeds AiTM AWS ConsoleLogin Impossible Travel via MFA Relay

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects consecutive successful AWS ConsoleLogin events for the same user originating from distinct IP addresses within a 10-minute window. This behavior is indicative of a session-based attack such as Adversary-in-the-Middle (AiTM) where session cookies are intercepted and replayed, allowing an attacker to bypass traditional authentication or multi-factor authentication controls.