# From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

Compromised AWS access key used to escape SES sandbox via multi-region PutAccountDetails, verify attacker domains, and send tax-themed phishing at 50k/day.

- Payout: Real-world hack
- Severity: high
- Program: Amazon
- Analysis by: Wiz Research
- Disclosed: 2025-09-04
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/wiz-discovers-cloud-email-abuse-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:aws technique:recon vuln:auth-bypass vuln:misconfiguration vuln:secrets-leak

**Target:** AWS SES email service and IAM access keys
**Root cause:** A leaked AWS access key with SES permissions allowed the attacker to call PutAccountDetails across all regions to move the account from sandbox to production mode, then verify new sender identities.
**Steps:**
1. Obtain compromised AWS access key with SES permissions
2. Call `GetCallerIdentity` to confirm key identity and SES provisioning
3. Probe `GetSendQuota` and `GetAccount` to check sandbox status
4. Burst `PutAccountDetails` across all AWS regions with boilerplate justification and unrelated construction company URL to exit sandbox
5. Attempt `CreateCase` API to raise quota (failed on permissions)
6. Attempt to create and attach `ses-support-policy` IAM policy for privilege escalation (failed)
7. Call `CreateEmailIdentity` to verify attacker-owned and weak-DMARC domains
8. Create sender addresses like `admin@`, `billing@`, `sales@`, `noreply@`
9. Send tax-themed phishing emails linking to credential theft site behind a redirect service
**How found:** Wiz Defend threat detection rules monitoring cloud telemetry flagged anomalous SES API activity; GetCallerIdentity revealed 'ses-' in key name, and a 10-second multi-region PutAccountDetails burst indicated automation.
**Exploitation:** With production mode enabled and 50,000 emails/day quota, attacker sent phishing referencing 2024 tax forms from verified domains to multiple organizations, linking to credential theft site irss[.]securesusa[.]com concealed behind a commercial traffic-analysis redirect to evade scanners and track clicks.
**Escalation:** Attempted to raise send quota via CreateCase and escalate IAM privileges via ses-support-policy; both failed, leaving standard production quota.
**Insight:** Watch for multi-regional bursts of PutAccountDetails and non-console CreateCase calls as early indicators of SES sandbox escape after key compromise; attackers monetize leaked keys via email services.