Attackers Abuse Amazon SES To Send Authenticated Phishing Emails

The report describes a growing trend where attackers exploit leaked AWS IAM keys to send highly convincing, authenticated phishing emails via Amazon Simple Email Service (SES), allowing messages to pass SPF/DKIM/DMARC checks and evade filters; it details how criminals harvest exposed credentials and recommends mitigations such as least-privilege IAM, role-based access, MFA, key rotation, IP restrictions, KMS, and user vigilance.