Attackers Abuse Amazon SES to Send Phishing That Passes Email Authentication

Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (SES) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (IAM) access keys discovered in public GitHub repositories, .env files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass SPF, DKIM, and DMARC, reducing the effectiveness of reputation-based filtering.

Observed campaigns included fake DocuSign notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to AWS Trust & Safety.