INVESTIGATOR CASEBOOK
• Bookmarked High-Priority Targets
Saved Scans & Case Evidence
Flagged incidents reserved for forensic review, red team emulation, or executive legal escalation.
CASE-NX-2026-0921
CRITICAL WEAPONIZED
amazon-verify-login.s3.amazonaws.com
Amazon credential harvester hosted on AWS S3 static website hosting bucket. Sovereign immunity stripped via multi-tenant sensor.
Assigned: CISO Incident Team
Status: Mitigated
CASE-NX-2026-0924
AITM REVERSE PROXY
login-microsoft-secure.online
Evilginx3 reverse-proxy targeting Office 365 enterprise tenants with automated session cookie replay.
Assigned: Threat Hunt Lead
Status: Active Triage