Agent Tesla Phishing Surge + Bank-Spoof Cloaking Network + AWS Bedrock Key Testing: OTX Credential-Theft Detection Pack

These four OTX pulses describe a single, converging objective across multiple campaigns: monetizable credentials—email identities, banking logins, and cloud access keys—then rapid validation and resale or follow-on intrusion.

1. Agent Tesla / large-scale email phishing (Q3 2026): OTX highlights continued industrial-scale phishing (billions of messages) with evolving evasion (SVG attachments, CAPTCHA-gated phishing, domain spoofing). The campaign targets credential theft and business email compromise across Legal, Retail, Manufacturing, Finance, with victimology spanning the US and Latin America (Chile, Colombia, Mexico) and Spain. Agent Tesla (S0331) remains a reliable workhorse for bulk credential harvesting due to mature builder tooling and multiple exfil methods.

2. US bank phishing network with anti-takedown cloaking: A finance-focused operation is using 248 live look-alike domains targeting 189 US financial institutions. The differentiator is a visitor-state cloaking mechanism: first-time visitors receive the credential harvest flow; returning visitors see a fake “account suspended” page to disrupt analysis, takedown, and reputation scoring. This is a direct attempt to defeat common defender workflows (URL re-checks, sandbox revisits, and blocklist validation).

3. AWS credential validation for Amazon Bedrock access: A separate but complementary trend: adversaries are systematically testing stolen AWS keys. The described behavior includes GetCallerIdentity validation followed by Bedrock capability checks (e.g., ListFoundationModels and related calls). The goal appears to be “token-jacking”/capability discovery—identifying keys that can access high-value LLM services for abuse (fraud automation, spam generation, model-assisted phishing, or cost-shifting compute theft).

4. GTA VI-themed lures (consumer credential and crypto theft): While consumer-oriented, these campaigns reinforce the broader credential-theft supply chain: social engineering + content lockers + trojanized downloads/APKs + crypto scams. For enterprises, the main risk is credential reuse and endpoint compromise when employees interact with these lures on corporate devices or networks.

Collective takeaway: credential theft is being productized end-to-end: (a) scalable phishing delivery (Agent Tesla), (b) resilient phishing infrastructure (cloaking and fake suspension pages), and (c) post-theft validation pipelines (AWS key testing against Bedrock).

Threat Actor / Malware Profile

Agent Tesla (S0331)

Primary objective: credential theft (mail clients, browsers, VPN/FTP, and stored secrets) and data exfiltration.

Common distribution methods observed in this pulse set:

• Email attachments and links (including SVG attachment delivery)
• Credential phishing pages (often CAPTCHA-gated to reduce automated scanning)
• Domain spoofing / look-alike infrastructure

Typical payload behavior (high level):

• Steals stored credentials from common browsers and email clients
• May capture keystrokes, clipboard data, screenshots (configuration dependent)
• Exfiltrates via SMTP, FTP, HTTP(S), or Telegram (varies by config)

Anti-analysis techniques frequently associated:

• Packing/obfuscation (commonly .NET packers)
• Sandbox checks and delayed execution
• CAPTCHA gating to reduce automated URL analysis
• Abuse of legitimate services for delivery and exfil (when configured)

Bank Phishing Network (Cloaking + Fake Suspended Pages)

Primary objective: harvest business banking credentials (and potentially MFA/session material) at scale across many US institutions.

Key technique:

• First-visit vs return-visit cloaking: serves phishing content to new visitors and a fake “account suspended” page to repeat visitors (analysts, scanners, takedown teams).

Operational impact:

• Higher survival rate of domains
• Reduced efficacy of quick verification (“site looks down/suspended”) during incident response and takedown requests

AWS Key Testing / Token-Jacking for Bedrock

Primary objective: validate stolen AWS credentials and identify those with Amazon Bedrock entitlements.

Behavior pattern:

• GetCallerIdentity to confirm key validity and account context
• Bedrock enumeration calls (e.g., ListFoundationModels) to determine access
• Likely follow-on abuse: LLM-enabled phishing content generation, automation of fraud, and resource consumption

IOC Analysis

Indicator types present

• Domains used for phishing delivery, impersonation, and lure infrastructure (e.g., look-alike banking domains and themed phishing domains)
• URLs that represent full credential-harvest paths (often cloud-document themed, e.g., “/onedrive/”)
• File hashes (SHA256) for payloads, lures, or tooling (including AWS-related validation tooling artifacts)

How SOC teams should operationalize these IOCs

1. Domains / URLs

• Add to DNS sinkhole / proxy blocklists (and CASB/SWG controls)
• Alert on first-seen domain access in proxy/DNS telemetry (not just “known bad”)
• For the bank-phishing network: ensure re-checks account for cloaking (validate with fresh sessions, multiple vantage points, and varied user agents)

2. File hashes

• Pivot in EDR for execution prevalence and parent/child process lineage
• Add to EDR blocklists where supported; also hunt by signer, original filename, and compile timestamps

3. Cloud credentials

• Treat any suspected exposure as active compromise until disproven
• Hunt CloudTrail for validation patterns (GetCallerIdentity bursts, Bedrock enumeration, new regions)

Recommended tooling

• Proxy/SWG + DNS logging for URL/domain coverage
• EDR for hash/process lineage
• SIEM correlation across email, web, endpoint, and cloud control plane logs
• Deobfuscation/URL extraction helpers (CyberChef for decoding embedded URLs; sandbox detonation for SVG/email attachments)

Detection Engineering

The detections below focus on behaviors highlighted in the pulses: phishing attachment execution (SVG/email), suspicious credential-theft process behavior, and AWS key validation for Bedrock access.

---
title: Suspicious SVG Attachment Execution Leading to Scripting or Browser Abuse
id: 7c1b7a9c-0f5f-4c9d-8f2a-3f3a6d0a9a10
status: experimental
description: Detects execution patterns consistent with phishing-delivered SVG attachments that spawn browsers, script interpreters, or LOLBins. Aligned to OTX reporting of SVG attachment phishing and CAPTCHA-gated credential theft campaigns.
author: Security Arsenal
date: 2026/11/07
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/
logsource:
  category: process_creation
  product: windows
detection:
  selection_svg:
    CommandLine|contains:
      - '.svg'
  selection_child:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
  condition: selection_svg and selection_child
falsepositives:
  - Rare legitimate SVG viewing workflows
level: medium
---
title: Potential Credential Theft Behavior - Suspicious Access to Browser Credential Stores
id: 1b9b3b6f-2e0c-4c4b-9d4a-5f8f0e9c2d21
status: experimental
description: Detects processes accessing browser credential store artifacts (e.g., Login Data) consistent with credential-stealing malware such as Agent Tesla configurations.
author: Security Arsenal
date: 2026/11/07
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
  selection_files:
    TargetFilename|endswith:
      - '\Login Data'
      - '\logins.json'
      - '\key4.db'
      - '\Web Data'
      - '\Cookies'
  filter_common:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_paths and selection_files and not filter_common
falsepositives:
  - Security tooling or backup software may legitimately read these files
level: high
---
title: AWS Credential Validation and Bedrock Enumeration Burst
id: 0f8d7c0d-5a2a-4f5d-9c0c-2a8b3d9f7e31
status: experimental
description: Detects suspicious bursts of AWS credential validation (GetCallerIdentity) and Amazon Bedrock enumeration (ListFoundationModels) that may indicate token-jacking and capability testing of stolen AWS keys.
author: Security Arsenal
date: 2026/11/07
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_validation:
    eventName:
      - 'GetCallerIdentity'
  selection_bedrock_enum:
    eventSource: 'bedrock.amazonaws.com'
    eventName:
      - 'ListFoundationModels'
      - 'ListModelCustomizationJobs'
      - 'ListProvisionedModelThroughputs'
  timeframe: 10m
  condition: selection_validation and selection_bedrock_enum
falsepositives:
  - Legitimate admin or automation validating access in a new environment
level: medium

// Hunt: OTX IOC domains + phishing URL paths (proxy via DeviceNetworkEvents)
// Scope: Last 14 days
let Lookback = 14d;
let Iocs = dynamic([
  "wekash.net","splace.co.za","carloxmextos.org",
  "gta6cyberleek.com","cyberleek.click","mygta6.icu","gta6keycodes.com","cyberleek.my","contact-rockstargames.com","cyberleek.cfd","cyberleek.world",
  "53primaryset.com","authorize-valley.com","commercial-atfirst.com","protect-pinnaclefp.com"
]);
let SuspiciousPaths = dynamic(["/onedrive/","/secure/","/login/","/verify/","/auth/"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteUrl has_any (Iocs)
   or RemoteUrl has_any (SuspiciousPaths)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), DistinctDevices=dcount(DeviceId), DistinctUsers=dcount(InitiatingProcessAccountName)
  by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by LastSeen desc;

// Hunt: Endpoint behavior consistent with phishing attachment execution (SVG) leading to suspicious child processes
// Scope: Last 14 days
let Lookback = 14d;
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ ("chrome.exe","msedge.exe","firefox.exe","rundll32.exe","wscript.exe","cscript.exe","powershell.exe","pwsh.exe","mshta.exe")
| where ProcessCommandLine has_any (".svg",".html",".htm")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

# IOC + artifact hunt (Windows): phishing infrastructure domains, suspicious SVG drops, and recent browser credential store access
# Run as an elevated user. Output: CSV files in .\otx_hunt_output\

$ErrorActionPreference = 'SilentlyContinue'
$OutDir = Join-Path $PSScriptRoot 'otx_hunt_output'
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

$domains = @(
  'wekash.net','splace.co.za','carloxmextos.org',
  'gta6cyberleek.com','cyberleek.click','mygta6.icu','gta6keycodes.com','cyberleek.my','contact-rockstargames.com','cyberleek.cfd','cyberleek.world',
  '53primaryset.com','authorize-valley.com','commercial-atfirst.com','protect-pinnaclefp.com'
)

# 1) Check DNS cache for IOC domain hits (fast triage)
$dnsHits = Get-DnsClientCache | Where-Object { $d=$_.Entry; $domains | ForEach-Object { $d -like "*$_*" } } |
  Select-Object Entry, RecordType, Status, Data
$dnsHits | Export-Csv -NoTypeInformation -Path (Join-Path $OutDir 'dns_cache_ioc_hits.csv')

# 2) Look for recently downloaded SVG/HTM artifacts in common user locations
$days = 14
$since = (Get-Date).AddDays(-1 * $days)
$userRoots = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:TEMP")
$fileHits = foreach ($root in $userRoots) {
  Get-ChildItem -Path $root -Recurse -Force -File |
    Where-Object { $_.LastWriteTime -ge $since -and ($_.Extension -in '.svg','.htm','.html','.js','.jse','.vbs','.ps1') } |
    Select-Object FullName, Extension, Length, CreationTime, LastWriteTime
}
$fileHits | Sort-Object LastWriteTime -Descending | Export-Csv -NoTypeInformation -Path (Join-Path $OutDir 'recent_script_html_svg_artifacts.csv')

# 3) Flag unusual processes with command lines referencing .svg/.html (requires process auditing or EDR for best fidelity)
$procHits = Get-CimInstance Win32_Process |
  Where-Object { $_.CommandLine -match '\.(svg|html?|js|vbs|ps1)\b' } |
  Select-Object ProcessId, Name, CommandLine, ParentProcessId, CreationDate
$procHits | Export-Csv -NoTypeInformation -Path (Join-Path $OutDir 'process_cmdline_script_svg_hits.csv')

# 4) Network connections to IOC domains (best-effort resolution)
$conn = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
$connEnriched = foreach ($c in $conn) {
  $p = Get-Process -Id $c.OwningProcess
  [pscustomobject]@{
    Time = Get-Date
    LocalAddress = $c.LocalAddress
    LocalPort = $c.LocalPort
    RemoteAddress = $c.RemoteAddress
    RemotePort = $c.RemotePort
    ProcessId = $c.OwningProcess
    ProcessName = $p.ProcessName
    ProcessPath = $p.Path
  }
}
$connEnriched | Export-Csv -NoTypeInformation -Path (Join-Path $OutDir 'established_connections_enriched.csv')

Write-Host "Wrote results to $OutDir"

Response Priorities

Immediate (0-24 hours)

• Block and alert on the OTX-provided domains and URLs at DNS, proxy/SWG, and email security layers.
• EDR sweep for the provided SHA256 hashes; pull full process lineage for any hits (parent/child, command line, signer, and network connections).
• For suspected phishing clicks: capture and preserve email headers, original attachment (SVG/HTML), and the full landing URL chain for analysis.

24 hours (Identity & credential containment)

• Treat credential-stealing malware exposure (Agent Tesla) as identity compromise:
  • Force password resets for impacted users
  • Revoke active sessions and refresh tokens
  • Re-issue MFA where feasible (phishing-resistant preferred)
• For AWS: immediately disable/rotate exposed keys, review CloudTrail for:
  • GetCallerIdentity bursts
  • Bedrock enumeration (ListFoundationModels and related calls)
  • New regions, new IAM users/roles, unexpected inline policy changes

1 week (Architecture hardening)

• Reduce phishing success:
  • Enforce stricter email attachment policies for SVG/HTML (convert-to-safe, sandbox detonation, or strip active content)
  • Strengthen DMARC enforcement and look-alike domain detection for brand and banking partners
• Reduce cloud key blast radius:
  • Move from long-lived access keys to short-lived credentials (SSO/IAM Identity Center)
  • Apply least privilege to Bedrock; restrict to approved roles and regions
  • Alert on first-time Bedrock usage by identity and on enumeration spikes
• Reduce bank-phishing impact:
  • Deploy conditional access policies for finance portals (device compliance + phishing-resistant MFA)
  • Implement “known banker portal” allowlisting for high-risk users (treasury/AP)

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub