Experts warn Amazon's Simple Email Service is being abused to launch 'massive volume' of phishing attacks
There's been an 'uptick' in Amazon SES atatcks lately
by https://www.techradar.com/uk/author/sead-fadilpai · TechRadarNews By Sead Fadilpašić published 5 May 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
- Attackers are hijacking exposed AWS credentials to send large‑scale phishing emails via Amazon SES
- Malicious messages bypass SPF, DKIM, and DMARC checks, landing directly in inboxes
- Researchers warn the trend is growing, urging stricter IAM practices and key management
The Amazon Simple Email Service (SES) is being abused to launch a “massive volume” of phishing attacks which easily bypass current defenses and expose victims to risks of credential and identity theft.
Security researchers Kaspersky sounded the alarm in a new report which noted, “Specifically, we’ve recently observed an uptick in phishing attacks leveraging Amazon SES."
The attackers start by stealing exposed AWS credentials. By using TruffleHog (or similar utilities), they scan GitHub repositories, .ENV files, Docker images, backups, and publicly accessible S3 buckets at scale, looking for login credentials for Amazon Web Services.
Article continues below
Passing all of the checks
Once found, they analyze permissions and email distribution capabilities: “After verifying the key’s permissions and email sending limits, attackers are equipped to spread a massive volume of phishing messages,” Kaspersky said.
The messages are carefully crafted, containing custom HTML templates that imitate legitimate services, and highly realistic login flows. The themes vary, from fake DocuSign documents, to Business Email Compromise (BEC) campaigns.
Being a legitimate service itself, Amazon SES allows the attackers’ emails to clear authentication checks such as SPF, DKIM, and DMARC protocols, landing the malicious messages directly into people’s inboxes. Furthermore, blocking by IP also doesn’t work, since it would ban all emails coming from Amazon SES.
“Phishing via Amazon SES is shifting from isolated incidents into a steady trend,” Kaspersky warned. “By weaponizing this service, attackers avoid the effort of building dubious domains and mail infrastructure from scratch. Instead, they hijack existing access keys to gain the ability to blast out thousands of phishing emails.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors