A sophisticated cybercriminal campaign has emerged, exploiting Amazon’s Simple Email Service (SES) to orchestrate large-scale phishing operations capable of delivering over 50,000 malicious emails daily.

The attack represents a significant evolution in cloud service abuse, transforming AWS’s legitimate bulk email platform into a weapon for credential theft and financial fraud.

The campaign begins with compromised AWS access keys, obtained through common attack vectors including accidental public exposure in code repositories, misconfigured cloud assets, or theft from developer workstations.

Once adversaries secure these credentials, they immediately probe the environment using GetCallerIdentity requests to assess available permissions, specifically targeting accounts with SES-related naming conventions that indicate email service access.

Wiz.io researchers identified this May 2025 campaign after detecting unusual patterns in AWS API activity across multiple regions.

The attackers demonstrated remarkable sophistication by implementing a multi-regional approach, simultaneously issuing PutAccountDetails requests across all AWS regions within seconds to escape SES’s default “sandbox” restrictions.

This technique, previously undocumented in security literature, allows threat actors to bypass the standard 200-email daily limit and unlock production mode capabilities.

The phishing infrastructure targets victims with convincing tax-related content, employing subject lines such as “Your 2024 Tax Form(s) Are Now Ready to View and Print” to maximize engagement rates.

These messages redirect users to credential harvesting sites hosted at domains like irss.securesusa.com, utilizing commercial traffic analysis services to obfuscate malicious infrastructure and evade traditional security scanners.

Technical Infrastructure and Evasion Mechanisms

The attackers establish their email infrastructure through systematic domain verification using the CreateEmailIdentity API.

They register both attacker-controlled domains including managed7.com, street7news.org, and docfilessa.com, alongside legitimate domains with weak DMARC configurations that facilitate email spoofing.

Each verified domain supports multiple email addresses using standard prefixes like admin@, billing@, and noreply@ to appear legitimate in recipient inboxes.

The campaign’s technical sophistication extends to automated privilege escalation attempts.

When standard production quotas proved insufficient, attackers programmatically created support tickets through the CreateCase API and attempted to establish IAM policies named “ses-support-policy” to gain enhanced permissions.

Although these elevation attempts failed due to insufficient privileges, the 50,000-email daily quota remained adequate for their operational requirements.

This SES abuse campaign demonstrates how cloud services designed for legitimate business purposes can be weaponized at scale, highlighting the critical need for enhanced monitoring of dormant access keys and unusual cross-regional API activity patterns in cloud environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Hackers Weaponize Amazon Simple Email Service to Send 50,000+ Malicious Emails Per Day appeared first on Cyber Security News.

Cybersecurity researchers have demonstrated a sophisticated technique for bypassing Web Application Firewalls (WAFs) using JavaScript injection combined with HTTP parameter pollution, exposing critical vulnerabilities in modern web security infrastructure.

The research, conducted during an autonomous penetration test, revealed how attackers can exploit parsing differences between WAF engines and web application frameworks to execute malicious code despite strict security configurations.

The vulnerability emerged during testing of an ASP.NET application protected by a highly restrictive WAF.

While the underlying Cross-Site Scripting (XSS) vulnerability was straightforward, involving breaking out of a JavaScript string delimited by single quotes, conventional XSS payloads were effectively blocked by the security system.

This scenario presented researchers with a classic challenge: demonstrating exploitability when defensive mechanisms actively prevent traditional exploitation methods.

The breakthrough came through understanding ASP.NET’s unique parameter handling behavior. When multiple HTTP parameters share the same name, ASP.NET concatenates their values using commas through the HttpUtility.ParseQueryString() method.

This documented Microsoft behavior states that “multiple occurrences of the same query string parameter are listed as a single entry with a comma separating each value.”

Ethiack analysts identified this parsing discrepancy as the key to bypassing WAF detection while maintaining valid JavaScript execution.

The attack leverages JavaScript’s comma operator, which allows multiple expressions to execute sequentially within a single statement.

By distributing malicious code across multiple parameters, researchers could construct payloads that appear benign individually but combine to form executable JavaScript.

For instance, the query string /?q=1'&q=alert(1)&q='2 becomes 1',alert(1),'2 after ASP.NET processing, creating syntactically valid JavaScript that executes the alert function when inserted into vulnerable contexts.

Technical Analysis and WAF Evasion Mechanisms

The research methodology involved testing 17 different WAF configurations across major cloud providers and security vendors, revealing significant disparities in detection capabilities.

The testing employed three distinct payload types, each demonstrating increasing sophistication in evasion techniques.

Framework parameter pollution behavior:-

The most revealing finding emerged from payload complexity analysis. Simple injection attempts achieved only a 17.6% bypass rate against tested WAFs, while sophisticated parameter pollution techniques reached 70.6% success rates.

The research identified three primary reasons for WAF vulnerability: individual parameter analysis without relationship understanding, lack of framework-specific parsing simulation, and reliance on traditional XSS signatures that miss functionally equivalent but structurally different payloads.

Payload effectiveness analysis:-

Autonomous testing systems demonstrated remarkable adaptability, discovering previously unknown bypasses for supposedly secure configurations.

Notably, Azure WAF was defeated using the payload test\\';alert(1);//, which exploits parsing discrepancies in escaped character handling between WAF pattern matching and JavaScript interpretation.

The research underscores the critical need for WAFs to implement framework-specific parsing logic and context-aware analysis capabilities, though such enhancements would significantly impact performance in production environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Researchers Bypassed Web Application Firewall With JS Injection with Parameter Pollution appeared first on Cyber Security News.