Digital Warfare Podcast Daily Brief June 25, 2026

The Digital Warfare Podcast · Jun 25, 2026 · 4m · transcript

Summary

A targeted AWS phishing campaign used an Adversary-in-the-Middle proxy to bypass traditional MFA by relaying credentials and MFA codes to the real AWS authentication service in real time. The attackers cloned the AWS console, adapted MFA prompts dynamically, captured authenticated sessions, and accessed victim accounts within minutes. The campaign shows why phishing-resistant authentication and session monitoring are now critical for cloud security.

Key Takeaways

• The campaign targeted fewer than 50 AWS-focused individuals, mainly software engineers.

• Attackers used cloned AWS login…