Exploiting Trust: Cybercriminals Weaponize Amazon SES to Bypass Email Defenses

Urgent: Phishing Campaigns Exploit Amazon's Trusted Email Service

Attackers are increasingly abusing Amazon Simple Email Service (Amazon SES) to launch phishing campaigns that bypass standard email security checks entirely. A recent uptick in such attacks has been observed, with scammers leveraging Amazon's legitimate infrastructure to trick victims.

“These emails sail through SPF, DKIM, and DMARC authentication because they are sent from a trusted provider,” said a senior security analyst at a major cybersecurity firm. “Users see amazonaws.com in links and let their guard down.”

Background: Amazon SES and Its Abuse

Amazon Simple Email Service (SES) is a cloud-based platform designed for reliable transactional and marketing email delivery. It integrates seamlessly with AWS, making it a staple for legitimate businesses.

However, its very trustworthiness is now being weaponized. Every email sent via SES passes all standard authentication protocols—SPF, DKIM, DMARC—and includes amazonses.com in message-ID headers. To email security systems, these phishing emails look completely legitimate.

How Attackers Execute the Scheme

Attackers gain access to Amazon SES through leaked IAM (AWS Identity and Access Management) access keys. These keys are often exposed in public GitHub repositories, environment files, Docker images, or publicly accessible S3 buckets.

Automated bots using tools like TruffleHog scan for these keys. Once found and verified, attackers can send massive volumes of phishing emails that appear legitimate.

Example: Fake Docusign Notifications

In early 2026, one of the most common themes was fake notifications from electronic signature services. Phishing emails imitating DocuSign used custom HTML templates provided by Amazon SES, making them nearly indistinguishable from real alerts.

Technical headers confirm the emails were sent via Amazon SES. From the recipient's perspective, everything looks authentic—until the link redirects to a phishing site instead of a legitimate one.

What This Means

Amazon SES phishing is exceptionally dangerous because it exploits a trusted channel. Security systems block malicious IPs, but the sender’s IP comes from a legitimate, reputable AWS blocklist that cannot be easily blacklisted without causing widespread disruption.

Organizations must monitor for leaked IAM keys and implement strict access controls. Users should be trained to verify unexpected emails even when they come from seemingly trusted domains.

Related Resources

• How IAM Keys Get Leaked
• Implications for Enterprise Security