Users who searched Google for AWS would see a fake landing page that impersonated a vegan food blog. Once on the site, users would be asked for their AWS login credentials.
The researchers first discovered the campaign Jan. 30 and uncovered that the campaign was likely based out of Brazil.