Researchers report Amazon SES abused in phishing to evade detection

Threat Overview

Cybersecurity firm Kaspersky reports that threat actors are increasingly exploiting Amazon Simple Email Service (SES) to deliver phishing campaigns that bypass traditional email security filters. By leveraging AWS's legitimate infrastructure, attackers generate emails that appear trustworthy to reputation-based security systems, making detection significantly more difficult. This tactic represents an evolution in social engineering — attackers are no longer just impersonating trusted brands, they're routing malicious messages through infrastructure those brands actually use. For independent healthcare practices, this means phishing emails targeting administrative credentials, patient data access, or financial information may now arrive with all the technical hallmarks of legitimate communication.

Attack Vector & Tactics

The abuse of Amazon SES demonstrates why technical indicators alone can't secure a healthcare practice. These campaigns succeed because:

• Infrastructure legitimacy: Emails originate from AWS IP ranges with strong sender reputation, passing SPF/DKIM authentication checks that many security tools rely on
• Credential targeting: Phishing messages impersonate common healthcare vendors, EHR providers, or clearinghouses to harvest login credentials for systems containing ePHI
• Filter evasion: Traditional blocklists and reputation systems fail because the sending infrastructure is shared with legitimate services practices actually use
• Human vulnerability: Even security-aware staff struggle to distinguish malicious messages when technical validation passes

The healthcare sector faces particular risk because practice workflows often require urgent email response — scheduling changes, patient emergencies, insurance authorizations — creating time pressure that undermines careful verification.

Defense Measures

Practices cannot rely solely on perimeter email filtering to stop these threats:

• Multi-factor authentication (MFA): Mandatory MFA on all systems containing ePHI means stolen credentials alone cannot grant access
• Security awareness training: Staff must verify unexpected requests through secondary channels before clicking links or entering credentials, regardless of apparent sender legitimacy
• Access logging: Immutable audit trails enable rapid detection of compromised accounts through anomalous login patterns or data access
• Least privilege access: Role-based permissions limit damage from any single compromised credential
• Incident response planning: Pre-defined breach procedures reduce response time from detection to containment

The IBM Security Cost of a Data Breach Report (2024) identifies a 258-day average breach lifecycle — organizations that detect and respond faster minimize exposure and regulatory penalties.

What This Means for Your Practice

This Kaspersky finding confirms what compliance-focused vendors often miss: technical checkboxes don't stop real attacks. A practice can have updated policies, annual training certificates, and signed BAAs while remaining operationally vulnerable to credential compromise through sophisticated phishing. The issue isn't whether your email provider has security features — it's whether your practice has continuous monitoring, access controls, and response capabilities that function when filters fail. Attackers targeting practices know most small healthcare organizations lack dedicated security staff and rely on external IT support that may not monitor for compromised credentials in real time.