From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

Wiz Research describes a May 2025 Amazon SES abuse campaign in which attackers leveraged compromised AWS access keys to bypass SES sandbox restrictions (including novel multi-regional PutAccountDetails requests), verify attacker and weakly protected domains, create sender identities, and send credential-theft phishing at scale; the report provides IoCs (domains and sender prefixes), outlines attacker TTPs and novel indicators (e.g., API-based CreateCase usage, multi-region PutAccountDetails bursts), and offers detection and mitigation guidance for defenders.