---
id: 6981
title: "From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/wiz-discovers-cloud-email-abuse-campaign"
published_at: "2025-09-04T16:39:21Z"
tags: ["cloud", "cloud-security", "aws", "threat-detection", "phishing", "credentials", "wiz-research", "amazon-ses"]
phying_url: "https://phying.com/item/6981"
lang: en
---

# From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

## Summary

Wiz Research traces an Amazon SES abuse campaign: a stolen AWS access key let attackers bypass sandbox limits, verify senders and run large-scale phishing; the patterns power new detection rules.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-09-04T16:39:21Z
- **Original:** https://www.wiz.io/blog/wiz-discovers-cloud-email-abuse-campaign
- **Phying News:** https://phying.com/item/6981