Skip to content
Threat Feed
Subscribe

Tag

Impossible-Travel

2 briefs RSS
medium advisory

AWS IAM User Console Login from Multiple Geolocations

Adversaries leverage adversary-in-the-middle (AiTM) phishing and session theft to compromise AWS IAM user credentials, leading to concurrent successful AWS Management Console logins from multiple distinct geographic locations, indicating account compromise and enabling unauthorized access to cloud resources despite MFA.

AWS Management Console +2 cloud identity aws initial-access credential-access aitm-phishing session-theft impossible-travel
2t
high advisory

Impossible Travel Detection in Azure AD

This brief describes the detection of 'impossible travel' events in Azure AD, where a user appears to log in from geographically distant locations within an implausibly short time frame, potentially indicating account compromise.

Azure Active Directory azuread identity-protection impossible-travel account-compromise lateral-movement
2r 1t