hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/$ROLE_NAMEURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 19 months ago
What the reports say
1 report, newest first · the exact sentence from each-
AWS SNS Abuse: Data Exfiltration and Phishing“CREDENTIALS=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/$ROLE_NAME)”
Indicators reported together
named in the same reports- hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/in 1 report
- protonmail[.]comin 1 report
- variables[.]tfin 1 report
- outputs[.]tfin 1 report
- hxxp://169.254.169[.]254/latest/api/tokenin 1 report
- hxxps://permiso[.]io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/in 1 report
- permiso[.]ioin 1 report
- hxxps://catalog.workshops[.]aws/build-sms-program/en-USin 1 report
- catalog.workshops[.]awsin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.