Amazon SES Weaponized for Phishing & BEC via Leaked AWS IAM Access Keys (Securelist, May 2026) — Threadlinqs Intelligence
As of 2026-05-30, Amazon SES Weaponized for Phishing & BEC via Leaked AWS IAM Access Keys (Securelist, May 2026) is a high-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0451 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Kaspersky/Securelist documents a 2026 trend in which threat actors harvest leaked AWS IAM access keys from public GitHub repos, ENV files, Docker images, configuration backups, and open S3 buckets —
OVERVIEW
In early 2026, Kaspersky's Roman Dedenok (Securelist, 2026-05-04) reported a sustained uptick in phishing and Business Email Compromise (BEC) campaigns abusing Amazon Simple Email Service (Amazon SES). Unlike commodity phishing that depends on freshly registered look-alike domains and quickly blocklisted infrastructure, this trend hinges on hijacking legitimate AWS tenants. The attacker piggybacks on Amazon's reputation, authentication footprint, and IP space. Because emission occurs from real AWS-owned IPs, with valid SPF/DKIM signatures and aligned DMARC, the messages bypass reputation, header-based, and protocol-level email defenses that secure operations centers traditionally rely upon.
INITIAL ACCESS — IAM ACCESS KEY HARVESTING
The campaign begins with credential acquisition rather than exploitation. Phisher infrastructure runs automated scrapers built around the open-source secret-detection utility TruffleHog and similar tools, continuously enumerating public GitHub repositories, mirror sites (e.g., GitHub commit history, gist.github.com), public S3 buckets, leaked Docker image layers (via Docker Hub and self-hosted registries), and exposed environment files (.env, config.yml, docker-compose.yml). Long-lived AWS IAM access keys, especially with patterns matching `AKIA[0-9A-Z]{16}`, are tested against AWS APIs to determine permission scope and SES sending limits (`GetSendQuota`, `ListIdentities`, `GetAccount`). Keys with attached `AmazonSESFullAccess`, `ses:SendEmail`, or overly permissive admin policies are retained for weaponization.
WEAPONIZATION — SES TENANT ABUSE
Once a valid key is identified, attackers use the AWS SDK or smtp credentials derived from the IAM key (Amazon SES SMTP credentials are deterministically derived from the IAM secret access key) to issue `SendEmail`, `SendBulkTemplatedEmail`, and `SendRawEmail` API calls. Custom HTML templates supplied via SES enable convincing brand impersonation. Because the legitimate tenant is already verified for one or more sender domains and has DKIM signing keys provisioned in Route53 (or equivalent DNS), every outbound message carries valid DKIM-Signature, an `X-SES-Outgoing` header, and a Message-ID of the form `<UUID@email.amazonses.com>` or `<UUID@*.amazonses.com>`. SPF passes via Amazon's published `_spf.amazonses.com` include directives. Provided the tenant's DMARC record is `p=none`/`p=quarantine`, the abusing email aligns and passes DMARC.
LURE CATALOG — DOCUSIGN AND BEC
In observed campaigns, two lure categories dominate: (1) Fake DocuSign / electronic-signature notifications inviting the victim to review and sign a document. The link in the email is masked as an `amazonaws.com` URL — typically a public S3 bucket or an `*.s3.amazonaws.com` static site hosting the phishing form — which redirects to or directly serves a credential-harvesting page styled after Microsoft 365, Google Workspace, or DocuSign sign-in. (2) BEC variants in which the attacker fabricates an entire reply chain between an internal employee and an external service provider regarding an outstanding invoice. The body contains the forwarded thread; PDF attachments include payment details and forged supporting documentation. Crucially, the PDFs in observed BEC samples carry no malicious URLs or QR codes — they are passive financial fraud documents intended to anchor the social-engineering ask. The email is addressed to finance / accounts payable, requesting urgent wire transfer to an attacker-controlled bank account.
WHY EMAIL CONTROLS FAIL
Standard defensive layers — sender reputation, IP blocklists, SPF/DKIM/DMARC enforcement, and even some BEC-tuned ML detectors that flag domain-anomaly senders — under-detect this campaign because: (a) the sending IP belongs to AWS (e.g., 23.249.208.0/20, 67.231.144.0/20, 199.122.120.0/22 SES ranges) and cannot safely be blocklisted; (b) authentication results report `dkim=pass header.d=<victim-tenant-domain>` and `spf=pass`; (c) Message-ID `.am
Weaknesses (CWE)
CWE-798, CWE-522, CWE-200, CWE-540, CWE-256, CWE-538
Target sectors: financial services, professional services, technology, manufacturing, healthcare, legal, real estate, education, retail, government
Target regions: Global, North America, Europe, Asia-Pacific, Latin America, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1593, T1593.003, T1596, T1586, T1586.003, T1583.006, T1585.002, T1608.002, T1078.004, T1566