Amazon SES increasingly abused in phishing to evade detection

Amazon Simple Email Service (SES) is being used by threat actors to send convincing phishing emails that bypass standard security filters and render reputation‑based blocks ineffective. The spike in abuse is driven by a large number of AWS IAM access keys exposed in public assets such as GitHub repositories, .ENV files, Docker images, backups, and S3 buckets. Attackers use TruffleHog to automatically scan for leaked keys, validate permissions, and then send high‑volume phishing messages. The phishing emails are crafted with custom HTML templates that mimic real services, including fake DocuSign notifications and business email compromise (BEC) attacks. Because SES is a trusted resource, attackers can send emails that pass SPF, DKIM, and DMARC checks, making IP‑based blocking ineffective. Kaspersky recommends restricting IAM permissions to the least privilege, enabling MFA, rotating keys regularly, and applying IP‑based access restrictions and encryption controls. The abuse highlights the need for tighter IAM key management and monitoring of public repositories for exposed credentials.

The article details how attackers automate the entire process: from key discovery to permission validation to email distribution, allowing unprecedented levels of abuse. The phishing quality is high, with realistic login flows and fabricated email threads that make the messages appear legitimate. The use of SES also means that blocking the service would disrupt legitimate email traffic.

Organizations should audit IAM policies, enforce MFA, rotate keys frequently, and monitor for leaked keys in public code repositories to mitigate this threat.