AWS IAM Credential Theft Fuels Ongoing Crypto Mining Campaign

A sophisticated cryptocurrency mining campaign targeting AWS customers began on November 2, 2025, using compromised AWS Identity and Access Management (IAM) credentials. The attackers exploited Amazon Elastic Container Service (ECS) and Elastic Compute Cloud (EC2) and employed advanced persistence techniques to extend their operations and evade detection. Amazon's GuardDuty detected the attack and raised a critical severity alert.