A separate campaign used a pen-testing framework to steal AWS credentials.