AWS S3 Bucket Hijacking for Replication Redirect via DeleteBucket then CreateBucket

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects a potential S3 bucket hijacking attempt where a bucket is deleted by one AWS account and subsequently recreated by a different AWS account within a 30-minute window. This behavior could indicate an attempt to intercept cross-account replication or misdirected data flows.