Loading story…
SentinelLABS reported active smishing campaigns using SNS Sender, a Python tool that sends bulk phishing text messages through compromised AWS Simple Notification Service (SNS) accounts. The tool requires stolen SNS credentials from accounts already provisioned for outbound messaging and not limited by the SNS sandbox, then rotates through credential lists and target phone numbers while inserting phishing links into message templates. Researchers linked the activity to the actor alias ARDUINO_DAS, which they said is associated with more than 150 phishing kits.
The campaigns heavily used USPS missed-package lures and directed victims to domains including usps[.]mytrackingh[.]top and u-sipsl[.]cc. On those sites, targets were prompted to submit personal details and payment card information, including a purported $0.30 redelivery fee. The findings highlight how attackers are increasingly misusing cloud communications platforms for large-scale spam and phishing, with AWS SNS account controls, IAM hygiene, and tighter messaging restrictions identified as key defenses.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLABS reported active phishing campaigns using the SNS Sender Python script to send bulk SMS messages through compromised AWS SNS accounts. The activity was linked to the actor alias ARDUINO_DAS and included USPS-themed lures hosted on domains such as usps[.]mytrackingh[.]top and u-sipsl[.]cc to steal personal and payment data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 178 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelOne reported that **Xeon Sender**, a Python-based cloud attack tool, is being used to send bulk SMS spam and smishing messages through legitimate APIs at multiple SaaS messaging providers using stolen or otherwise valid customer credentials. The tool was first observed in 2022 and has since been repeatedly rebranded by different threat actors, while retaining largely the same codebase and functionality across versions. Xeon Sender supports nine SMS providers and includes features for credential checking, phone number validation, and number generation, enabling operators to automate large-scale message delivery through provider-specific libraries or crafted HTTP requests. Researchers said the activity reflects abuse of compromised accounts rather than software flaws in the providers, and highlighted defensive indicators including anomalous SMS permission changes, recipient list uploads, and suspicious API activity such as `GetSMSAttributes` and `SetSMSAttributes` in AWS environments.
Jul 12, 2026
Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (**SES**) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (**IAM**) access keys discovered in public GitHub repositories, `.env` files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass **SPF**, **DKIM**, and **DMARC**, reducing the effectiveness of reputation-based filtering. Observed campaigns included fake **DocuSign** notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to **AWS Trust & Safety**.
Jun 29, 2026
Threat actors are increasingly abusing **trusted SaaS platforms and email authentication** to deliver high-conviction scam lures that evade traditional filtering. Trend Micro reported a targeted spam operation that weaponizes **Atlassian Cloud** features to send messages that pass common checks (e.g., **SPF/DKIM**) due to the strong reputation of SaaS sender domains; the campaign is multilingual and aims to redirect government and corporate recipients to **fraudulent investment** landing pages using **Keitaro TDS**, with attackers creating multiple Atlassian instances for resilience and scale. Separately, Forcepoint X-Labs described phishing emails impersonating the **US Social Security Administration** that deliver a `.cmd` script to weaken Windows defenses (including disabling **SmartScreen**, removing **Mark-of-the-Web**, and using **Alternate Data Streams**) before silently installing **ConnectWise ScreenConnect** as a remote-access backdoor (including a hardcoded callback configuration). Related research highlighted **DKIM replay attacks**, where adversaries forward legitimate, DKIM-signed vendor emails (e.g., PayPal/DocuSign-style invoices and dispute notices) so the unchanged content continues to validate and can pass **DMARC**, increasing inbox placement and user trust for follow-on social engineering.
Jun 29, 2026