{"id":24719,"date":"2026-06-16T10:15:31","date_gmt":"2026-06-16T03:15:31","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24719"},"modified":"2026-07-14T09:54:07","modified_gmt":"2026-07-14T02:54:07","slug":"hackers-are-using-aws-infrastructure-to-bypass-all-email-security-systems","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/hackers-are-using-aws-infrastructure-to-bypass-all-email-security-systems\/","title":{"rendered":"Hackers are using AWS infrastructure to bypass all email security systems"},"content":{"rendered":"

Summary of the campaign<\/span><\/h2>\n

Since the beginning of 2026, Kaspersky has noted a significant increase in phishing campaigns and Business Email Compromise (BEC) exploiting Amazon Simple Email Service (SES) – not through software vulnerabilities, but via leaked AWS IAM access keys. By hijacking a third party’s key, attackers send thousands of phishing emails without the cost of building their own infrastructure. What sets this campaign apart: emails are sent from Amazon’s infrastructure – bypassing SPF, DKIM, DMARC, originating from non-blocklisted IPs, and containing redirect links through amazonaws.com. From a technical standpoint, the emails appear completely legitimate.<\/span><\/p>\n

Two main attack branches have been identified:<\/span><\/p>\n

Regular phishing – impersonating DocuSign notifications, leading victims to a fake login page on amazonaws.com to steal credentials.<\/span><\/p>\n

BEC\/Invoice Fraud – impersonating internal email threads about payment invoices, including a PDF without malicious URLs to bypass scanners, aiming to trick the finance department into transferring money.<\/span><\/p>\n

\"834984c5<\/a><\/p>\n

Timeline & background<\/span><\/h2>\n\n\n\n\n\n\n\n\n
Time<\/strong><\/span><\/th>\nEvent<\/span><\/th>\n<\/tr>\n<\/thead>\n
2024\u20132025<\/span><\/td>\nPhishing through legitimate cloud services (Microsoft 365, Google Workspace) becomes a popular trend.<\/span><\/td>\n<\/tr>\n
Early Q1 2026<\/span><\/td>\nKaspersky noted a significant spike in phishing campaigns sent through Amazon SES.<\/span><\/td>\n<\/tr>\n
04\/05\/2026<\/span><\/td>\nKaspersky publishes a detailed analysis report on Securelist.<\/span><\/td>\n<\/tr>\n
Currently<\/span><\/td>\nTrend shifts from isolated incidents \u2192 steady, ongoing campaign<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This campaign is not a sudden phenomenon\u2014it’s a natural progression of the trend where attackers shift towards “Living off Trusted Services” (LoTS): instead of building their own easily blockable domains, they rent or hijack the infrastructure of major providers with high reputations.<\/span><\/p>\n

Attack chain<\/span><\/h2>\n

\"8d9ac24f<\/a><\/p>\n

Phase 1 – Reconnaissance & credential harvesting (T1552.001)<\/strong><\/span><\/h3>\n

Attackers use automated tools, most commonly TruffleHog (open-source, scans for secrets in git history and code), to hunt for exposed AWS IAM access keys in public sources.<\/span><\/p>\n