SHARE

Amazon SES Turned Rogue: 50K Phishing Emails a Day

Hackers abuse Amazon SES to send 50K+ phishing emails daily, spoofing domains and evading detection.

Written By

Sep 8, 2025

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A newly uncovered cybercriminal campaign has transformed Amazon’s Simple Email Service (SES) into a large-scale phishing weapon, sending over 50,000 malicious emails per day.

“Beyond brand damage, this enables phishing that looks like it came from you and can be used for spearphishing, fraud, data theft, or masquerading in business processes,” Wiz researchers wrote, outlining this SES attack.

The operation represents a significant escalation in cloud service abuse and highlights how attackers are repurposing legitimate infrastructure for financial fraud and credential theft.

How the SES attack works

The SES abuse campaign followed a deliberate and highly automated chain of steps that began with something all too common in cloud environments: compromised access keys. Attackers likely obtained credentials through public code leaks, misconfigured cloud assets, or stolen developer endpoints, then used them to access the victim’s AWS account.

The hackers began reconnaissance with GetCallerIdentity to confirm the stolen key’s permissions, spotted SES-related naming that signaled email abuse potential, and then used GetSendQuota and GetAccount to verify whether the account was limited to SES’s 200-email-per-day sandbox restrictions.

Attackers bypassed SES sandbox limits by issuing PutAccountDetails requests across all AWS regions simultaneously, an unprecedented tactic that elevated accounts to production mode with a 50,000-email quota. This multi-regional automation maximized quotas, evaded controls, and built redundancy against regional restrictions.

Building and operating the phishing infrastructure

After reaching production mode, attackers used CreateEmailIdentity to verify domains — including attacker-owned sites like managed7.com and legitimate domains with weak DMARC — enabling large-scale spoofing of trusted identities.

Attackers created addresses like admin@ and noreply@ on verified domains and paired them with tax-themed lures such as “Your 2024 Tax Form(s) Are Now Ready to View and Print” to evade spam filters and trick recipients into engaging.

When the 50,000-email quota proved insufficient, attackers tried escalating privileges by opening AWS support tickets via CreateCase and adding a custom “ses-support-policy” IAM policy. Though unsuccessful, the default quota still enabled large-scale phishing.

By combining stolen credentials, automation, domain setup, and quota abuse, attackers turned SES into a large-scale phishing platform, with activity that mimicked normal AWS usage and evaded traditional detection.

What makes this SES abuse particularly dangerous

The SES abuse campaign highlights the growing risk of cloud service exploitation, where attackers do not need to introduce custom malware but instead weaponize legitimate platforms that enterprises already trust.

Because the phishing emails originate from Amazon’s infrastructure, they inherit the credibility of AWS’s reputation, making them more difficult for security tools, and end users, to identify as malicious.

With a single stolen access key, attackers can send tens of thousands of phishing emails daily while spoofing brand domains, leaving organizations vulnerable to both compromise and reputational damage. SES abuse can trigger abuse reports, cloud service suspension, and regulatory scrutiny if phishing from a compromised AWS account exposes customer data.

Business email compromise (BEC) stemming from these attacks can lead to financial fraud, while stolen cloud credentials may be repurposed to access additional services within the victim’s environment.

Security teams must extend monitoring to cloud-native threats like dormant keys, cross-regional activity, and high-volume API use, or risk detecting abuse only after damage occurs. As cloud adoption grows, safeguarding access keys and monitoring cross-regional activity are as critical as patching, since even legitimate services can be weaponized.

Steps security teams can take to reduce risk

Security teams should treat SES abuse as an indicator of compromised cloud credentials. The Wiz researchers recommend mitigation steps that include:

Blocking SES in unused accounts with AWS Service Control Policies.
Regularly rotating IAM keys and monitoring dormant ones for unusual activity.
Enforcing least privilege so only approved roles can verify senders or request production access.
Using CloudTrail and CloudWatch to flag anomalies, such as PutAccountDetails bursts, CreateCase API calls, or email-sending spikes.

For broader defense strategies, organizations can enhance their cloud security posture through the enforcement of multi-factor authentication and zero-trust security.

While cloud platforms drive efficiency and scale, this case highlights how they can also be exploited for malicious purposes.

To stay ahead, security leaders should assume attackers will keep probing for ways to weaponize legitimate services and reinforce defenses with strong cloud security best practices.

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.