From social engineering to Lambda modification

Researchers discovered a sophisticated attack initiated through social engineering on LinkedIn and WhatsApp, leading to credential theft via seemingly benign code downloads. With stolen session tokens and cloud access keys, the attackers authenticated into Microsoft 365 and AWS, bypassing MFA and other controls. They then modified a Lambda function to execute commands on EC2 instances—exploiting legitimate permissions to blend in with normal operations.