Datadog Security Research investigated an adversary-in-the-middle (AiTM) phishing campaign from June 2026. This campaign cloned the AWS console login page to harvest victim credentials and multi-factor authentication (MFA) codes. The use of AiTM techniques allows attackers to bypass traditional MFA protections, posing a significant threat to cloud accounts.