Attackers Abuse Amazon SES to Send Authenticated Phishing Emails That Bypass Security

Cybersecuritynews •Tushar Subhra Dutta • May 5, 2026

Threat actors are increasingly turning to Amazon’s own cloud email infrastructure to deliver phishing messages that look completely genuine, passing every standard security check along the way. Phishing has always been deception. Attackers craft emails designed to look real, hoping recipients will trust what they see and hand over their credentials or money. For […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Amazon SES Phishing Attacks Bypass Email Security Measures In early 2026, a surge in phishing attacks utilizing Amazon Simple Email Service (SES) has been reported, exploiting exposed AWS Identity and Access Management (IAM) access keys. Attackers leverage this trusted email infrastructure to send convincing phishing emails that pass standard security checks, including SPF, DKIM, and DMARC. The phishing emails often mimic legitimate services, such as electronic signature notifications from DocuSign, tricking users into revealing sensitive information. Researchers attribute this increase in phishing campaigns to the widespread exposure of AWS credentials found in public repositories and other accessible locations. Automated tools like TruffleHog are used by attackers to find these leaked keys, allowing them to send large volumes of phishing messages. The attacks have raised significant concerns among cybersecurity experts, as blocking the IP addresses used for these emails would disrupt legitimate communications. Recommendations for organizations include enforcing strict IAM permissions, enabling multi-factor authentication, and regularly rotating access keys. 5 sources 70

Extracted Entities

Attackers Abuse Amazon SES to Send Authenticated Phishing Emails That Bypass Security

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)