{"id":240529,"date":"2026-05-04T16:03:00","date_gmt":"2026-05-04T20:03:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/"},"modified":"2026-05-06T17:40:09","modified_gmt":"2026-05-06T21:40:09","slug":"researchers-report-amazon-ses-abused-in-phishing-to-evade-detection","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/","title":{"rendered":"Researchers report Amazon SES abused in phishing to evade detection"},"content":{"rendered":"<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/\">Researchers report Amazon SES abused in phishing to evade detection<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-05-04 16:03:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.bleepingcomputer.com\">www.bleepingcomputer.com<\/a><\/p>\n<p style=\"text-align:center\">\n<p>Cybersecurity firm Kaspersky reports that the Amazon Simple Email Service (SES) is being increasingly abused\u00a0to send convincing phishing emails that can bypass standard security filters and render reputation-based blocks ineffective.<\/p>\n<p>Although the resource has been leveraged for malicious activity in the past, Kaspersky says the current spike may be due to a large number of AWS Identity and Access Management access keys exposed in public assets.<\/p>\n<p>Because it is a legitimate, trusted resource, phishing operations can leverage Amazon SES to send out malicious emails that pass authentication checks.<\/p>\n<p>Kaspersky researchers note in a report today that they&#8217;ve \u201cobserved an uptick in phishing attacks leveraging Amazon SES\u201d to deliver links that redirect to a malicious site.<\/p>\n<p><img decoding=\"async\" alt=\"Headers on phishing email\" height=\"167\" src=\"https:\/\/www.bleepstatic.com\/images\/news\/u\/1220909\/2026\/April\/headers.jpg\" width=\"900\"\/><strong>Headers on phishing email<\/strong><br \/>Source: Kaspersky<\/p>\n<p>The researchers believe the main driver of this abuse is the increasing exposure of AWS credentials in GitHub repositories, .ENV files, Docker images, backups, and publicly accessible S3 buckets.<\/p>\n<p>Finding the access keys is typically done in an automated way using bots built on the open-source TruffleHog utility, which is designed to scan for leaked secrets.<\/p>\n<p>Threat actors now rely on automated attacks that streamline secret scanning, permission validation, and email distribution, enabling unprecedented levels of abuse.<\/p>\n<p>\u201cAfter verifying the key\u2019s permissions and email sending limits, attackers are equipped to spread a massive volume of phishing messages,\u201d\u00a0Kaspersky explains.<\/p>\n<p>Based on their findings, the researchers say that the phishing quality is high, featuring custom HTML templates that mimic real services and realistic login flows.<\/p>\n<p>The observed attacks include fake document-signing notifications that imitate DocuSign to lead victims to AWS-hosted phishing pages, as well as more advanced business email compromise (BEC) attacks.<\/p>\n<p>Attackers fabricate entire email threads to make the phishing messages appear\u00a0more convincing and&#8230;<\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Researchers report Amazon SES abused in phishing to evade detection https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-report-amazon-ses-abused-in-phishing-to-evade-detection\/ Publish Date: 2026-05-04 16:03:00&#8230;<\/p>\n","protected":false},"author":1,"featured_media":240530,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/05\/04\/AWS.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,25],"class_list":["post-240529","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-phishing"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/240529"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=240529"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/240529\/revisions"}],"predecessor-version":[{"id":240531,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/240529\/revisions\/240531"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/240530"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=240529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=240529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=240529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}