180 fake sign-in pages, and most of them are your AWS console

Your cloud console login is the single most valuable page your business touches, and it is trivially cloneable. Censys just published a map of an operator running 180 labeled web properties — a large share of them fake AWS console sign-in pages — sitting on infrastructure that also stages a full iOS exploit chain. If your team reaches AWS by clicking a link, this fake AWS console phishing campaign is your problem, not a headline about nation-state tooling.

What actually happened

Censys senior security researcher Aidan Holland published the infrastructure analysis on July 31, mapping the operator as of July 30. The count: 180 labeled web properties across multiple base domains, with the largest single cluster — jkonnet[.]buzz — holding 36 of them. The decoys include an AWS-console impersonation cluster and an iCloud/Apple sign-in page, which Censys calls the first Apple-branded decoy it has seen bundled directly with exploit staging infrastructure.

Hosting concentrates in Hong Kong (15 of 27 identified servers, across a dozen distinct networks), with the rest spread across Japan, Singapore, the United States, Germany, and France. The infrastructure churns weekly.

The payload side: DarkSword is a leaked exploit kit chaining six vulnerabilities across iOS 18.4 through 18.7. On success it deploys GHOSTBLADE, which drops keychain, iCloud, and Wi-Fi credential-dumping modules, sweeps files out, then runs anti-forensics cleanup. The Hacker News reported on August 3 that the kit's source leaked publicly, putting it in more hands than the original operator's, and that evidence links this activity to a cluster tracked as UNC6353. Treat the attribution as reported, not established — the infrastructure count is the part that's independently mapped.

Why a fake AWS console login matters for your business

Read the combination, not the two halves. This is a credential-harvesting page and a drive-by exploit stage on the same domain. Someone who lands there, decides it looks wrong, and closes the tab without typing anything can still have handed over their keychain.

Three things worth doing this week, all of them cheap.

Stop reaching consoles through links. AWS, Azure, Google Cloud, your bank, your registrar — bookmark them, or type them. This is unglamorous advice that has been correct for fifteen years and is the single control that defeats every one of those 180 domains. A link in an email or a Slack message that lands on a login page gets typed into nothing.

Move root and admin logins to phishing-resistant MFA. A cloned page happily collects a TOTP code and replays it. A passkey or a hardware security key is bound to the real origin and simply will not fire on jkonnet[.]buzz. If your AWS root account still uses an authenticator app, that's the highest-value hour on your list.

Check your iOS versions. The chain covers 18.4 through 18.7. Anyone on your team running a phone a few point releases behind is inside the window. Pull up your MDM, or if you don't have one, ask — it takes five minutes and one of the answers will surprise you.

The nation-state framing makes this feel like someone else's threat model. It isn't. Leaked kits get commoditized fast, and a fake AWS login page doesn't check whether you're a defense contractor or a five-person shop with an S3 bucket.

Sources: Censys, The Hacker News.