Loading story…
SentinelOne reported that Xeon Sender, a Python-based cloud attack tool, is being used to send bulk SMS spam and smishing messages through legitimate APIs at multiple SaaS messaging providers using stolen or otherwise valid customer credentials. The tool was first observed in 2022 and has since been repeatedly rebranded by different threat actors, while retaining largely the same codebase and functionality across versions.
Xeon Sender supports nine SMS providers and includes features for credential checking, phone number validation, and number generation, enabling operators to automate large-scale message delivery through provider-specific libraries or crafted HTTP requests. Researchers said the activity reflects abuse of compromised accounts rather than software flaws in the providers, and highlighted defensive indicators including anomalous SMS permission changes, recipient list uploads, and suspicious API activity such as GetSMSAttributes and SetSMSAttributes in AWS environments.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-07, SentinelOne published a report detailing Xeon Sender's support for nine SMS providers, credential-checking and phone-number utilities, and its use of provider-specific libraries or crafted HTTP requests. The report also stated that the abuse stemmed from compromised accounts rather than vulnerabilities in the providers.
After its initial appearance, Xeon Sender was repeatedly rebranded by different threat actors while retaining little meaningful code divergence across versions. It was distributed through Telegram channels, cybercrime forums, and a hosted web GUI.
SentinelOne reported that the Python-based Xeon Sender cloud attack tool was first observed in 2022. The tool was used to send bulk SMS spam and smishing messages through legitimate APIs of SaaS messaging providers using stolen or otherwise valid credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS reported active smishing campaigns using **SNS Sender**, a Python tool that sends bulk phishing text messages through compromised AWS Simple Notification Service (SNS) accounts. The tool requires stolen SNS credentials from accounts already provisioned for outbound messaging and not limited by the SNS sandbox, then rotates through credential lists and target phone numbers while inserting phishing links into message templates. Researchers linked the activity to the actor alias **ARDUINO_DAS**, which they said is associated with more than 150 phishing kits. The campaigns heavily used **USPS missed-package** lures and directed victims to domains including `usps[.]mytrackingh[.]top` and `u-sipsl[.]cc`. On those sites, targets were prompted to submit personal details and payment card information, including a purported **$0.30** redelivery fee. The findings highlight how attackers are increasingly misusing cloud communications platforms for large-scale spam and phishing, with AWS SNS account controls, IAM hygiene, and tighter messaging restrictions identified as key defenses.
Jul 12, 2026
SentinelLABS reported that **AlienFox** is a modular toolkit used to steal credentials and API secrets from misconfigured cloud and SaaS email environments, with a particular focus on **AWS SES** and **Microsoft Office 365**. The toolkit has been distributed mainly through Telegram, with some components also appearing on GitHub, and operators use internet-exposed asset sources such as **LeakIX** and **SecurityTrails** to find vulnerable hosts. Once access is found, AlienFox parses configuration and environment files on exposed servers to extract secrets that can be reused for follow-on abuse. Later AlienFox versions automate several post-compromise actions, including AWS persistence, privilege escalation, SES quota collection, and bulk spam activity using stolen credentials. SentinelLABS said versions 2 through 4 have been observed since February 2022 and noted recurring overlap with tooling previously tracked as **Androxgh0st** and **GreenBot**. The activity reflects a broader shift in cloud-focused crime away from pure cryptomining and toward opportunistic abuse of smaller cloud services for fraud, spam, and account compromise.
Jun 29, 2026
Threat actors are increasingly abusing **trusted SaaS platforms and email authentication** to deliver high-conviction scam lures that evade traditional filtering. Trend Micro reported a targeted spam operation that weaponizes **Atlassian Cloud** features to send messages that pass common checks (e.g., **SPF/DKIM**) due to the strong reputation of SaaS sender domains; the campaign is multilingual and aims to redirect government and corporate recipients to **fraudulent investment** landing pages using **Keitaro TDS**, with attackers creating multiple Atlassian instances for resilience and scale. Separately, Forcepoint X-Labs described phishing emails impersonating the **US Social Security Administration** that deliver a `.cmd` script to weaken Windows defenses (including disabling **SmartScreen**, removing **Mark-of-the-Web**, and using **Alternate Data Streams**) before silently installing **ConnectWise ScreenConnect** as a remote-access backdoor (including a hardcoded callback configuration). Related research highlighted **DKIM replay attacks**, where adversaries forward legitimate, DKIM-signed vendor emails (e.g., PayPal/DocuSign-style invoices and dispute notices) so the unchanged content continues to validate and can pass **DMARC**, increasing inbox placement and user trust for follow-on social engineering.
Jun 29, 2026