Loading story…
AWS customers reported receiving sharply inflated billing alerts and forecasted monthly charges after an issue in AWS Billing and Cost Management caused incorrect estimated cost data to appear in the console. A notice cited in customer reports said the problem began on July 16 at 7:38 PM PDT, and affected displayed estimates and alerting rather than reflecting actual resource consumption.
Administrators said the erroneous figures reached extreme levels and appeared across multiple environments and services, including Amazon S3, prompting concern that accounts had been compromised or runaway workloads were active. Reports indicate the incident was an AWS-side display and alerting problem tied to billing estimates and AWS Budgets, with customers advised not to treat the inflated totals as real charges while AWS worked the issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Beginning on July 16 at 7:38 PM PDT, AWS started displaying incorrect estimated billing data in the Billing and Cost Management Console. The issue also affected AWS Budgets and triggered inaccurate billing alerts with inflated forecasted monthly costs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourcetechcrunch.com
Open sourcereddit.com
Open sourcehealth.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon leadership directed engineering teams to address a series of recent **high-impact availability incidents** that internal notes and reporting tied in part to **“Gen-AI assisted changes,”** citing that best practices and safeguards for these tools are not yet fully established. Following disruptions including a reported multi-hour impairment of the main retail site attributed to an erroneous code deployment, Amazon moved to tighten deployment governance by requiring **senior engineer approval** for AI-assisted changes and elevating attendance expectations for an operations review meeting led by SVP **Dave Treadwell**. Reporting also linked at least two **AWS** operational incidents to the use of AI coding assistants being rolled out internally. One incident involved a prolonged interruption to an AWS cost calculator after an AI coding tool (reported as *Kiro*) made changes that resulted in deleting and recreating an environment; Amazon characterized that event as limited in scope and geography, and said another AI-linked incident did not impact a customer-facing AWS service. Separately, some engineers attributed increased severity-2 incident volume to staffing reductions, while Amazon disputed that layoffs were responsible for the outage pattern and described the availability review process as part of normal continuous improvement.
Jun 29, 2026
A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack. The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.
Jun 29, 2026
Datadog Security Labs reported an active **adversary-in-the-middle (AiTM)** phishing campaign targeting **AWS Management Console** users with high-fidelity cloned login pages hosted on **typosquatted domains**. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to **validate credentials** and capture **session material** (and likely **MFA/OTP codes**) before redirecting victims, enabling rapid post-compromise access to cloud environments. In an observed case, the threat actor accessed a compromised AWS account **within ~20 minutes** of credential submission, with console access originating from `185.209.196.132` (identified as a **Mullvad VPN** egress). Datadog identified **two active infrastructure clusters** and a third related domain, including `cloud-recovery[.]net` (IP `178.16.54[.]142`), `cloud-policy[.]com` (IP `69.67.172[.]30`), and `cloud-recovery[.]us`, with shared registrar metadata (Registrar ID **3254**, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is **credential theft** rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender `noreply@security[.]aws`.
Jun 29, 2026