JavaGhost SES abuse (Campaign)

JavaGhost evolved from defacements to sustained cloud phishing (2022–2024) by exploiting exposed long-term AWS access keys to access SES and WorkMail and send phishing from trusted infrastructure; they used IAM manipulation (creating users/roles with admin privileges), temporary credential APIs (GetFederationToken, GetSigninToken) and urllib3 to generate console sign-in URLs, established cross-account trust for persistence, and employed evasion techniques such as avoiding GetCallerIdentity and leaving subtle artifacts (e.g., empty EC2 security groups named "Java_Ghost").