50,000 Emails a Day: How a Cloud Flaw Is Fueling Phishing Campaigns

The Wiz Research team revealed details of a May 2025 phishing campaign that weaponised Amazon Simple Email Service (SES) using compromised AWS keys. The operation stood out for its scale and for its use of previously undocumented attack patterns designed to bypass SES restrictions and deliver phishing at industrial scale.

According to Wiz, the attacker first compromised an AWS access key, used the key to access the victim’s AWS environment, bypass SES’s built-in restrictions, verify new sender identities, and methodically prepare and conduct a phishing operation. SES accounts default to sandbox mode, limited to 200 messages per day to verified addresses, but the attacker sought production by abusing the PutAccountDetails API, with a burst of multi-regional requests observed within ten seconds across all AWS regions.

AWS support approved the request, granting a quota of 50,000 emails per day, enough to power a significant phishing campaign. The attacker then created a phishing infrastructure by verifying attacker-owned and weakly protected domains such as managed7[.]com, street7news[.]org, street7market[.]net and docfilessa[.]com, distributing emails with prefixes like admin@, billing@ and noreply@.