Amazon SES increasingly abused in phishing to evade detection

Kaspersky researchers observed a rising campaign that abuses Amazon SES—using exposed AWS IAM access keys discovered in public repos and assets—to send high-quality phishing and BEC emails that bypass SPF/DKIM/DMARC and reputation-based blocks; attackers automate secret scanning, permission checks, and mass distribution (often hosting phishing pages on AWS). The report highlights attack techniques (fabricated threads, DocuSign-style lures, fake invoices), recommends least-privilege IAM, MFA, key rotation, IP restrictions and provides guidance for reporting abuse to AWS Trust & Safety.