AWS CLOUDFORMATION PHISHING ATTACK: A GROWING THREAT

Summary from the TLDR InfoSec newsletter

The AWS CloudFormation phishing attack begins with fake AWS Support emails containing a "Launch Stack" button that redirects victims to the AWS CloudFormation console. Clicking it deploys a template that creates an IAM role with admin privileges and a trust policy for the attacker's account. The IAM Role ARN is sent to the attacker's API Gateway, resulting in complete account compromise through privilege escalation, resource creation, and data exfiltration, avoiding detection.