Hackers Exploit Amazon SES to Blast Over 50,000 Malicious Emails Daily

Hackers are abusing Amazon’s Simple Email Service (SES) to blast over 50,000 malicious emails daily, a campaign described as a sophisticated cloud-based phishing operation. According to Wiz Research, the abuse was identified in May 2025, revealing how compromised AWS credentials can be weaponised to turn SES into phishing infrastructure and bypass common email security controls.

The attackers began with GetCallerIdentity to confirm SES permissions, then escalated by probing SES with GetSendQuota and GetAccount to assess sandbox limits before switching accounts to production mode, which typically raises the quota to about 50,000 emails per day. In a multi‑regional burst, they reportedly issued PutAccountDetails across AWS regions within ten seconds to maximise region-specific quotas.

After gaining production access, they added multiple domains as verified identities and launched a broad phishing campaign referencing 2024 tax forms, directing recipients to credential theft sites via redirects. The report highlights security risks for organisations using cloud services, including potential damage to reputation and business operations, and recommends measures such as strict IAM controls, production access auditing, and comprehensive SES activity monitoring.