Kaspersky's Amazon SES token was stolen by unauthorized individuals

The attackers did not attempt to impersonate Kaspersky but used the official Kaspersky email address to disguise spear-phishing emails as outdated 'fax notifications' and send them to potential victims, and then lure users to visit fake websites to collect authorization certificates for Microsoft online services.

Amazon SES is an expandable email service launched by Amazon, which allows developers to send emails from any application to meet various email sending needs, including marketing and bulk email. Phishers have taken advantage of this to send emails from the Amazon Web Services endpoint, easily bypassing most secure email gateways (SEG) to reach the target email box, and by changing different sender addresses, achieve the purpose of large-scale sending of phishing emails.

Kaspersky issued a notice stating that the Amazon SES token was stolen during the testing period of the 2050.earth website. Since the website is hosted by Amazon, the SES token was revoked immediately after these phishing attacks were discovered, so the 2050.earth website and related servers were not damaged, and no unauthorized database access or other malicious activities were found.

Kaspersky warns users to be cautious of similar spear-phishing emails, especially when asked to provide authorization certificates and other sensitive information. Do not be complacent even if the sender is a familiar brand. noreply@sm.kaspersky.com is an email address of a phishing email sender disclosed by Kaspersky, and users can also visit the Kaspersky blog to view detailed information about the sender's identity through the email subject.

Highly evasive spear-phishing campaigns against Office 365 have been frequent, resulting in the theft of a large amount of user data. As a stakeholder, Microsoft has been continuously sending alerts to remind users to be vigilant.

Reference Source: https://www.bleepingcomputer.com/news/security/kasperskys-stolen-amazon-ses-token-used-in-office-365-phishing/