Legion: an AWS Credential Harvester and SMTP Hijacker

Researchers have discovered a Python-based credential harvesting and hack tool named Legion, which is sold via the Telegram messenger.

Legion is designed to exploit various services for email abuse, including SMTP servers, Apache vulnerabilities, and AWS services, among other things. The tool also includes modules to brute-force cPanel and WebHost Manager (WHM) accounts and offers utilities for abusing AWS services.

Legion was found to be related to AndroxGh0st, another malware family discovered by Lacework in December 2022. Legion includes the ability to deliver SMS spam messages to US mobile users, retrieve AWS console credentials, and implant webshells.