Amazon SES - Tool

Threat entity extracted from intelligence sources

Frequency
5
occurrences
First Seen
November 16, 2025
Last Seen
May 5, 2026

Amazon SES (Simple Email Service) is a scalable, cloud-based email sending platform from AWS used for transactional and marketing emails.

Overview

Amazon SES (Simple Email Service) is a scalable, cloud-based email sending platform from AWS used for transactional and marketing emails. While legitimate and widely adopted, SES can be abused by threat actors to conduct phishing campaigns, deliver malware, or exfiltrate data via email by leveraging trusted infrastructure, making abuse harder to detect unless properly mitigated and monitored.

Related Threat Clusters

  • Amazon SES Phishing Attacks Bypass Email Security Measures

    In early 2026, a surge in phishing attacks utilizing Amazon Simple Email Service (SES) has been reported, exploiting exposed AWS Identity and Access Management (IAM) access keys. Attackers leverage this trusted email…

    8 articles · Updated May 4, 2026
  • Coinbase Breach Timeline Disputed by Security Researcher

    A security researcher claims that Coinbase was aware of a breach affecting nearly 70,000 customers since December 2024, but did not disclose it until months later. The researcher, Jonathan Clark, reported the incident…

    3 articles · Updated November 17, 2025
  • Coinbase Breach Timeline Disputed by Security Researcher

    A security researcher claims that Coinbase was aware of a security breach in December 2024, where attackers bribed support staff to access nearly 70,000 customer details, at least four months before the company…

    3 articles · Updated November 17, 2025

Recent Intelligence Reports

  • Attackers Abuse Amazon SES to Send Authenticated Phishing Emails That Bypass Security — Cybersecuritynews · May 5, 2026
  • Amazon SES increasingly abused in phishing to evade detection — Bleepingcomputer · May 4, 2026
  • Security researcher calls BS on Coinbase breach disclosure timeline — Theregister · November 17, 2025
  • Security researcher calls BS on Coinbase breach disclosure timeline — Theregister · November 17, 2025
  • I have recordings proving Coinbase knew about breach months before disclosure — News.Ycombinator · November 16, 2025

CVSS v3.1 Breakdown