Cybercriminals Weaponize Amazon SES in Sophisticated Phishing Surge

Breaking: Attackers Hijack Trusted Email Service to Bypass Security

Cybersecurity researchers are warning of a sharp rise in phishing campaigns that exploit Amazon Simple Email Service (SES), a legitimate cloud-based email platform. The attacks evade traditional defenses by using authenticated, trusted infrastructure.

“These emails pass all SPF, DKIM, and DMARC checks because they are sent through Amazon’s own servers,” said Dr. Emily Tran, threat analyst at SecureNet Labs. “From a technical standpoint, every message looks completely legitimate.”

How the Attack Works

Attackers gain access to Amazon SES via leaked AWS Identity and Access Management (IAM) keys, often found in public GitHub repositories or exposed configuration files. Once verified, they send massive volumes of phishing emails that appear to come from trusted sources.

The phishing emails use custom HTML templates and redirect links hosted on amazonaws.com domains. Victims clicking on what seems like a safe link are taken to credential-stealing pages.

Authentication Bypass

Because Amazon SES is a recognized sender, the attacker’s IP addresses are not blacklisted. Blocking all SES traffic would disrupt legitimate businesses that rely on the service, making widespread filtering impractical.

“This is a classic example of abusing trust,” commented Mark Johansson, CTO of PhishGuard. “Security systems are trained to whitelist Amazon, and attackers exploit that blind spot.”

Background

Amazon Simple Email Service (SES) is designed for reliable delivery of transactional and marketing emails. It is widely integrated into AWS ecosystems. Recent reports show a spike in phishing using SES, with themes like fake DocuSign notifications.

The attack vector involves automated tools like TruffleHog to hunt for exposed IAM keys. Once compromised, attackers send thousands of phishing messages before detection.

What This Means

Organizations must treat any email from an Amazon SES domain with caution, even if it passes authentication. Security teams should monitor for unusual SES activity, such as spikes in outbound email from unexpected accounts.

“This attack shifts the burden from detection to prevention,” Tran added. “Companies need to enforce stricter IAM key hygiene and consider advanced email filtering that looks beyond authentication.”