Experts warn Amazon's Simple Email Service is being abused to launch 'massive volume' of phishing attacks

Date:
Tue, 05 May 2026 15:50:00 +0000

Description:
Hackers are stealing access to legitimate AWS tools and using them to launch phishing campaigns.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers are hijacking exposed AWS credentials to send largescale phishing emails via Amazon SES Malicious messages bypass SPF, DKIM, and DMARC checks, landing directly in inboxes Researchers warn the trend is growing, urging stricter IAM practices and key management The Amazon Simple Email Service (SES) is being abused to launch a massive volume of phishing attacks which easily bypass current defenses and expose victims to risks of credential and identity theft.

Security researchers Kaspersky sounded the alarm in a new report which noted, Specifically, weve recently observed an uptick in phishing attacks leveraging Amazon SES." The attackers start by stealing exposed AWS credentials. By
using TruffleHog (or similar utilities), they scan GitHub repositories, .ENV files, Docker images, backups, and publicly accessible S3 buckets at scale, looking for login credentials for Amazon Web Services. Article continues
below You may like The vast majority of phishing attacks are now generated by AI, experts warn How businesses can defend themselves against the rise of phishing as a service Free email accounts contributing to nearly half of all commercial spam Passing all of the checks Once found, they analyze
permissions and email distribution capabilities: After verifying the keys permissions and email sending limits, attackers are equipped to spread a massive volume of phishing messages, Kaspersky said.

The messages are carefully crafted, containing custom HTML templates that imitate legitimate services, and highly realistic login flows. The themes vary, from fake DocuSign documents, to Business Email Compromise (BEC) campaigns.

Being a legitimate service itself, Amazon SES allows the attackers emails to clear authentication checks such as SPF, DKIM, and DMARC protocols, landing the malicious messages directly into peoples inboxes. Furthermore, blocking
by IP also doesnt work, since it would ban all emails coming from Amazon SES.

Phishing via Amazon SES is shifting from isolated incidents into a steady trend, Kaspersky warned. By weaponizing this service, attackers avoid the effort of building dubious domains and mail infrastructure from scratch. Instead, they hijack existing access keys to gain the ability to blast out thousands of phishing emails. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

To mitigate the risks, Kaspersky recommends users implement the principle of least privilege when configuring IAM access. They also recommend
transitioning from IAM access keys to roles when configuring AWS, and
enabling multi-factor authentication.

IP-based access restrictions should be configured, as well as automated key rotation. Finally, users should use the AWS KEy Management Service to encrypt data and manage keys from a centralized location. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/experts-warn-amazons-simple-email-servi ce-is-being-abused-to-launch-massive-volume-of-phishing-attacks


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)