AWS Billing Console Error Triggered False High-Cost Alerts

Amazon leadership directed engineering teams to address a series of recent **high-impact availability incidents** that internal notes and reporting tied in part to **“Gen-AI assisted changes,”** citing that best practices and safeguards for these tools are not yet fully established. Following disruptions including a reported multi-hour impairment of the main retail site attributed to an erroneous code deployment, Amazon moved to tighten deployment governance by requiring **senior engineer approval** for AI-assisted changes and elevating attendance expectations for an operations review meeting led by SVP **Dave Treadwell**. Reporting also linked at least two **AWS** operational incidents to the use of AI coding assistants being rolled out internally. One incident involved a prolonged interruption to an AWS cost calculator after an AI coding tool (reported as *Kiro*) made changes that resulted in deleting and recreating an environment; Amazon characterized that event as limited in scope and geography, and said another AI-linked incident did not impact a customer-facing AWS service. Separately, some engineers attributed increased severity-2 incident volume to staffing reductions, while Amazon disputed that layoffs were responsible for the outage pattern and described the availability review process as part of normal continuous improvement.

Mar 10, 2026

Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack. The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.

Dec 16, 2025

AiTM Phishing Campaign Hijacking AWS Console Sessions via Typosquatted Domains

Datadog Security Labs reported an active **adversary-in-the-middle (AiTM)** phishing campaign targeting **AWS Management Console** users with high-fidelity cloned login pages hosted on **typosquatted domains**. The kit acts as a live proxy to the legitimate AWS sign-in flow, relaying authentication in real time to **validate credentials** and capture **session material** (and likely **MFA/OTP codes**) before redirecting victims, enabling rapid post-compromise access to cloud environments. In an observed case, the threat actor accessed a compromised AWS account **within ~20 minutes** of credential submission, with console access originating from `185.209.196.132` (identified as a **Mullvad VPN** egress). Datadog identified **two active infrastructure clusters** and a third related domain, including `cloud-recovery[.]net` (IP `178.16.54[.]142`), `cloud-policy[.]com` (IP `69.67.172[.]30`), and `cloud-recovery[.]us`, with shared registrar metadata (Registrar ID **3254**, CNOBIN INFORMATION TECHNOLOGY LIMITED) and signs of rapid infrastructure rotation. Reporting emphasized the activity is **credential theft** rather than exploitation of an AWS vulnerability or abuse of AWS infrastructure, and that the lure impersonates an “AWS Organization Security” alert with a likely spoofed sender `noreply@security[.]aws`.

Mar 9, 2026

AWS Billing Console Error Triggered False High-Cost Alerts

How this story unfolded

AWS billing console begins showing incorrect estimated cost data

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

AWS Billing Console Error Triggered False High-Cost Alerts

How this story unfolded

AWS billing console begins showing incorrect estimated cost data

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

AWS Billing Console Error Triggered False High-Cost Alerts

How this story unfolded

AWS billing console begins showing incorrect estimated cost data

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Amazon Tightens Change Controls After Outages Linked to AI-Assisted Code Changes

Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

AiTM Phishing Campaign Hijacking AWS Console Sessions via Typosquatted Domains

AWS Billing Console Error Triggered False High-Cost Alerts

How this story unfolded

AWS billing console begins showing incorrect estimated cost data

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Amazon Tightens Change Controls After Outages Linked to AI-Assisted Code Changes

Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

AiTM Phishing Campaign Hijacking AWS Console Sessions via Typosquatted Domains