The Fireflies Meeting Recap That Never Happened: Dual-Brand Impersonation via Amazon SES

Attackers used authenticated Amazon SES infrastructure to send a dual-brand phishing email impersonating Fireflies.ai and Microsoft Teams to a financial controller; the email included legitimate Fireflies assets and PDFs but contained a single credential-harvesting link (https://authorzeyadkareem.com/) that resolved to a malicious page. IRONSCALES detected the campaign via malicious URL analysis, first-time sender anomaly, and community intelligence, quarantining four mailboxes before any clicks; IOCs include sobiznet.com, authorzeyadkareem.com, [email protected], IP 54.240.3.9, and the provided SES message ID.