Detection of Adversary-in-the-Middle Session Theft via Geographic Implausibility

Adversary-in-the-middle (AiTM) phishing kits represent a significant threat to cloud authentication by capturing both credentials and multi-factor authentication (MFA) tokens in real-time. When an attacker utilizes these stolen session cookies to access the AWS Management Console, they operate from their own infrastructure, which is often geographically divergent from the legitimate user's location. This activity results in physically implausible login patterns where the same IAM user account authenticates from two or more distinct countries within a very brief window.

Defenders can identify this activity by monitoring AWS CloudTrail 'ConsoleLogin' events for successful authentications that occur in rapid succession from different geographic regions. This detection logic serves as a cloud-native equivalent to identity-provider impossible-travel alerts, providing high-fidelity signal for account compromise even when MFA challenges appear successfully satisfied, as the AiTM kit relays these challenges to the victim during the initial phishing interaction.

Impact

Successful exploitation of this technique allows unauthorized actors to bypass MFA-protected login flows, gaining persistent or transient access to AWS management interfaces. If undetected, this can lead to privilege escalation, data exfiltration, and unauthorized changes to IAM policies or access keys. Impacted organizations face potential exposure of critical cloud resources and sensitive data.

Recommendation

Prioritize the implementation of geographic-based anomaly detection for AWS console logins to identify session theft.

• Deploy detection logic to aggregate 'ConsoleLogin' events by IAM user identity and flag instances where the user successfully authenticates from multiple distinct countries within a 65-minute window.
• Review all flagged events by inspecting the 'source_geo_country_iso_code' and 'source_ip' values in CloudTrail to confirm if the activity aligns with expected user behavior or known VPN/proxy egress points.
• Evaluate the use of IAM Identity Center with phishing-resistant MFA, specifically FIDO2/passkey hardware tokens, which natively defeat AiTM relay attacks.
• Conduct an immediate response review for any account triggering this alert, including resetting passwords, revoking active console sessions, and rotating access keys.