Urgent: Phishing Campaigns Exploit Amazon's Trusted Email Service
Attackers are increasingly abusing Amazon Simple Email Service (Amazon SES) to launch phishing campaigns that bypass standard email security checks entirely. A recent uptick in such attacks has been observed, with scammers leveraging Amazon's legitimate infrastructure to trick victims.
“These emails sail through SPF, DKIM, and DMARC authentication because they are sent from a trusted provider,” said a senior security analyst at a major cybersecurity firm. “Users see amazonaws.com in links and let their guard down.”
Background: Amazon SES and Its Abuse
Amazon Simple Email Service (SES) is a cloud-based platform designed for reliable transactional and marketing email delivery. It integrates seamlessly with AWS, making it a staple for legitimate businesses.
However, its very trustworthiness is now being weaponized. Every email sent via SES passes all standard authentication protocols—SPF, DKIM, DMARC—and includes amazonses.com in message-ID headers. To email security systems, these phishing emails look completely legitimate.
How Attackers Execute the Scheme
Attackers gain access to Amazon SES through leaked IAM (AWS Identity and Access Management) access keys. These keys are often exposed in public GitHub repositories, environment files, Docker images, or publicly accessible S3 buckets.
Automated bots using tools like TruffleHog scan for these keys. Once found and verified, attackers can send massive volumes of phishing emails that appear legitimate.
Example: Fake Docusign Notifications
In early 2026, one of the most common themes was fake notifications from electronic signature services. Phishing emails imitating DocuSign used custom HTML templates provided by Amazon SES, making them nearly indistinguishable from real alerts.
Technical headers confirm the emails were sent via Amazon SES. From the recipient's perspective, everything looks authentic—until the link redirects to a phishing site instead of a legitimate one.
What This Means
Amazon SES phishing is exceptionally dangerous because it exploits a trusted channel. Security systems block malicious IPs, but the sender’s IP comes from a legitimate, reputable AWS blocklist that cannot be easily blacklisted without causing widespread disruption.
Organizations must monitor for leaked IAM keys and implement strict access controls. Users should be trained to verify unexpected emails even when they come from seemingly trusted domains.