Amazon Said You Owe $879. The Phone Number Was the Payload.

A high-severity TOAD (Telephone-Oriented Attack Delivery) vishing campaign impersonating Amazon.de used authenticated Amazon SES infrastructure (DKIM/DMARC/SPF passed) and legitimate Amazon redirect links to evade email security; the message claimed an $879 USD charge, lacked transactional details, and directed victims to call (865) 292-7594 — the phone number is the sole malicious payload. IOCs include [email protected], sending IP 54.240.1.30, relay IP 44.206.222.91, return-path domain driftpulse.de, and the fraudulent charge amount.