Executive Summary
Between June 16 and 19, 2026, threat actors launched a targeted Adversary-in-the-Middle (AiTM) phishing campaign against US-based software engineers and engineering leadership. The campaign utilized a variation of the PoisonSeeds phishing kit, which was observed impersonating AWS and SendGrid login portals to harvest administrative credentials and bypass multi-factor authentication (MFA).
The attack employs a server-driven flow that identifies victims via a unique 'input_24' URL parameter. This gating mechanism ensures the phishing page only renders for specific targets, evading automated sandboxes and security researchers. By relaying authentication requests in real time, the kit successfully captures TOTP codes, SMS codes, and email-based MFA challenges, granting attackers full access to targeted AWS environments.
This activity highlights a shift toward high-value console access over simple API key theft. Organizations should immediately monitor for the provided indicators and review AWS CloudTrail 'ConsoleLogin' events for anomalies following connections to these suspicious domains.