Malware

SNS Sender

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence1

Sending SMS messages containing malicious links, often impersonating a legitimate service.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

SNS Sender provides a more narrow approach that relies on the actor having access to a properly configured AWS SNS tenant.

Initial Access

5 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

T1566PhishingEvidence1

The script replaces any occurrences of the string linkas in the message content variable with a URL from the links.txt file, which weaponizes the message as a phishing SMS.

T1566.002Spearphishing LinkEvidence1

“Sending SMS messages containing malicious links, often impersonating a legitimate service.”

T1566.003Spearphishing via ServiceEvidence1

Compromised AWS environments with pre-configured SNS services can serve as launchpads for smishing (SMS phishing) or phishing attacks. Adversaries may exploit legitimate SNS topics and subscribers to distribute fraudulent messages internally or externally.

Persistence

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Stealth

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence1

The script takes several arguments that are entered as input: A text file containing a list of AWS access keys, secrets, and region delimited by a colon.

INDICATORS OF COMPROMISE

IOCs tracked for this family

132 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

126 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app1 year ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

sentinelone labsNews

May 7, 2026

Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials | SentinelOne

A related tool referenced as part of the trend of abusing cloud services to send SMS spam and smishing messages.

sentinelone labsNews

Apr 11, 2025

SNS Sender | Active Campaigns Unleash Messaging Spam Through the Cloud | SentinelOne

A Python-based bulk SMS spamming tool that abuses AWS SNS to send smishing messages containing phishing links, including USPS-themed delivery lures aimed at stealing PII and payment card data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching132

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

SNS Sender

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence1

Sending SMS messages containing malicious links, often impersonating a legitimate service.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

SNS Sender provides a more narrow approach that relies on the actor having access to a properly configured AWS SNS tenant.

Initial Access

5 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

T1566PhishingEvidence1

The script replaces any occurrences of the string linkas in the message content variable with a URL from the links.txt file, which weaponizes the message as a phishing SMS.

T1566.002Spearphishing LinkEvidence1

“Sending SMS messages containing malicious links, often impersonating a legitimate service.”

T1566.003Spearphishing via ServiceEvidence1

Persistence

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Stealth

2 techniques

T1078Valid AccountsEvidence2

The script requires valid AWS SNS credentials compromised from an environment not subject to the SNS sandbox restrictions.

T1078.004Cloud AccountsEvidence1

“Actions taken via the AWS CLI are attributed to the IAM role attached to the EC2 instance” and SNS Sender uses “compromised AWS credentials.”

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence1

The script takes several arguments that are entered as input: A text file containing a list of AWS access keys, secrets, and region delimited by a colon.

INDICATORS OF COMPROMISE

IOCs tracked for this family

132 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

126 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app1 year ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

sentinelone labsNews

May 7, 2026

Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials | SentinelOne

A related tool referenced as part of the trend of abusing cloud services to send SMS spam and smishing messages.

sentinelone labsNews

Apr 11, 2025

SNS Sender | Active Campaigns Unleash Messaging Spam Through the Cloud | SentinelOne

A Python-based bulk SMS spamming tool that abuses AWS SNS to send smishing messages containing phishing links, including USPS-themed delivery lures aimed at stealing PII and payment card data.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching132

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.