Amazon SES (Simple Email Service ), designed for reliable, mass email delivery by businesses, is becoming a tool in the hands of cybercriminals . According to new analysis, the platform is increasingly being used to send convincing phishing emails that bypass traditional security filters and sender reputation detection mechanisms.
From a legitimate service to a vehicle for cyberattacks
The irony behind this development is that Amazon SES is a perfectly legitimate and trusted cloud service. However, this very feature is exploited by attackers, as emails sent through Amazon's infrastructure are more likely to pass authentication checks and reach victims' inboxes without being blocked.
Compounding the situation, much of the abuse appears to be coming from exposed AWS Identity and Access Management (IAM) credentials found in public repositories like GitHub, .ENV configuration files, Docker images, backups, and public S3 buckets. This allows attackers to gain access to legitimate accounts and use them to send malicious emails.
See also: Apache MINA: Vulnerabilities allow RCE attacks
Automated search for stolen credentials
Security researchers note that finding access keys is no longer done manually. Instead, automated tools and bots, such as the open-source tool TruffleHog, which is designed to detect exposed secrets in public code and repositories.
Once valid credentials are identified, attackers immediately test them for email sending permissions and usage limits. If access is confirmed, a fully automated process is triggered to send large-scale phishing campaigns.
The new generation of phishing is more persuasive than ever
Kaspersky , in a recent analysis , reports that it has recorded a significant increase in phishing attacks that leverage Amazon SES. The most worrying aspect is not only the volume, but also the quality of the attacks.
Attackers use advanced HTML templates that closely mimic real services, creating realistic login flows and environments that are difficult to distinguish from the authentic ones. In many cases, phishing pages are also hosted on AWS infrastructure, enhancing their credibility in the eyes of victims.
BEC attacks and social engineering at the operational level
In addition to classic phishing emails, there is also an increase in Business Email Compromise (BEC), where attackers target high-value business processes. In these scenarios, entire email threads to give the impression of real communication between partners or suppliers.
Fake invoices or payment requests are often sent , with the aim of deceiving financial departments of companies and transferring money to the attackers' accounts.
See also: CISA: cPanel & WHM Vulnerability in KEV Catalog
One particularly dangerous element is that, by using Amazon SES, attackers no longer need to worry about traditional verification mechanisms like SPF, DKIM, and DMARC, which are typically used to detect fake senders.
The limitations of blocking and the broader problem
Addressing this phenomenon is extremely difficult. Blocking IP addresses associated with malicious activity is not a practical solution, as it would also lead to disruption of legitimate email traffic based on Amazon SES. This creates an operational dilemma for security providers and enterprises.
At the same time, analysts emphasize that the problem is not limited to SES. Cybercriminals are constantly looking for ways to abuse legitimate email services, as they offer higher success rates and lower detection.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Security recommendations and defense strategies
Kaspersky recommends that enterprises adopt a more stringent approach to access management. Key measures include restricting IAM permissions based on the principle of least privilege, enabling multi-factor authentication, regularly rotating access keys , and implementing IP-based restrictions and encryption policies.
The logic behind these practices is to reduce the attack surface even when credentials are leaked, limiting the potential for abuse.
See also: Hackers gained access to Trellix source code
Amazon's position and official reaction
In an official statement, Amazon reiterated its security guidelines for protecting against exposed credentials and preventing unauthorized access to AWS accounts. A company spokesperson emphasized that users who suspect malicious use of their resources can report incidents to the AWS Trust & Safety for investigation.
This development highlights a broader problem in the cloud ecosystem: the more trusted a service is, the more attractive it becomes for abuse when it falls into the wrong hands. Balancing ease of use and security remains a critical issue for the next generation of cloud infrastructure and email services.
Source: www.bleepingcomputer.com
