Kaspersky Reports Phishing Abuse of Amazon SES Using Exposed AWS Keys

Summary

Kaspersky reports that attackers are using exposed AWS keys to send convincing phishing through Amazon SES, with campaigns including DocuSign-themed lures and BEC scams. It recommends tighter IAM controls, MFA, key rotation, and IP restrictions.

Key points

Kaspersky researchers report an uptick in phishing campaigns using Amazon SES to deliver links to malicious sites.
The researchers identify exposed AWS IAM keys in public repositories, .env files, Docker images, backups, and S3 buckets as a likely driver.
Attackers reportedly use automated tools, including TruffleHog, to find secrets, check permissions, and send large volumes of email.
Observed lures include fake DocuSign document-signing notices and fabricated email threads and invoices used in BEC scams.
The article says SES can help phishing emails pass SPF, DKIM, and DMARC checks, while blocking sending IPs could also block legitimate SES email.
Kaspersky recommends least-privilege IAM permissions, MFA, regular key rotation, and IP-based access restrictions; AWS advises reporting suspected abuse to its Trust & Safety team.

Article Details

Event Type: Phishing and business email compromise campaigns abusing exposed AWS IAM access keys to send email through Amazon SES.
Impact: The phishing emails can pass SPF, DKIM, and DMARC checks and evade reputation-based blocking. Reported lures include DocuSign-themed messages and fabricated email threads and invoices targeting finance teams; the article does not report confirmed financial losses.