Threat Actor 'JavaGhost' Targets AWS Environments in Phishing Scheme

**JavaGhost cloud phishing campaign:** Unit 42 reports that JavaGhost has been exploiting exposed long‑term AWS IAM access keys and misconfigured environments since 2022 to establish persistent phishing infrastructure, using victim Amazon SES/WorkMail to send emails that evade detection; the group employs CloudTrail evasion techniques (avoiding GetCallerIdentity, creating temporary console credentials) and benefits from missing dataplane logging, while recommended mitigations include enabling dataplane logging and tightening IAM permissions.