Skip to content
Threat Feed
Subscribe

Tag

Session-Theft

3 briefs RSS
medium advisory

Detection of Adversary-in-the-Middle Session Theft via Geographic Implausibility

This brief describes a method for detecting Adversary-in-the-Middle (AiTM) phishing and session theft in AWS environments by identifying IAM user console logins originating from geographically distinct locations within a short timeframe.

AWS Management Console +1 cloud-security aws session-theft identity
2t updated
high advisory

Open WebUI Same-Origin XSS via Terminal Port Preview

An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.

Open WebUI +5 web-vulnerability xss session-theft web-application ssrf cve-2026-87996 vulnerability denial-of-service +5
3r 5t 1c updated
medium advisory

AWS IAM User Console Login from Multiple Geolocations

Adversaries leverage adversary-in-the-middle (AiTM) phishing and session theft to compromise AWS IAM user credentials, leading to concurrent successful AWS Management Console logins from multiple distinct geographic locations, indicating account compromise and enabling unauthorized access to cloud resources despite MFA.

AWS Management Console +2 cloud identity aws initial-access credential-access aitm-phishing session-theft impossible-travel
2t