Two active campaigns are defeating email security and MFA by routing attacks through Amazon and Microsoft's own systems. Here is what CISOs need to know right now.
An employee at a financial services firm opens an email. The sender clears every technical check: SPF passes, DKIM passes, domain reputation is clean. The message has no typos, no misspelled URLs, no gift card requests. It lands in the inbox without a flag. The employee clicks, authenticates, completes the multi-factor verification prompt, and by 9:03 a.m., the attacker holds a valid Microsoft 365 session token with full access to the account.
Two documented campaigns released this week show exactly how this is happening at organizations across industries, and why the defenses most security teams rely on are the wrong tools for these specific attacks.
Every email security product built over the last decade operates on one foundational assumption: malicious email comes from malicious senders. Reputation scoring, domain blocklists, and IP filtering are all designed to answer the same question. Can we trust where this message came from?
For years, that assumption held. Attackers ran phishing campaigns from cheap, newly registered domains with no sending history, and email filters caught most of them. The two campaigns documented this week expose exactly where that assumption breaks down. Both achieved delivery by routing attacks through infrastructure that security tools already trust. The emails looked legitimate because, at the infrastructure level, they were. Once that delivery problem was solved, all that remained was engineering the human decision on the other end.
Case One: Amazon's Email Infrastructure, Turned Against You
Amazon Simple Email Service (SES) is the bulk email engine behind thousands of recognized products globally. Software platforms use it to send receipts. SaaS tools use it for notifications. It sits inside Amazon's IP space, carries Amazon's DKIM signatures, and passes Amazon's SPF records.
Security researchers documented this week that attackers have now established a reliable method for using SES as a phishing delivery vehicle. The setup requires no sophistication: create an AWS account, configure SES, craft a convincing email, and send it through Amazon's servers. Every technical verification layer that an enterprise email gateway runs returns a clean result.
Reputation-based blocking, which most organizations treat as their primary defense against phishing, has no foothold here. Amazon's sending reputation is built on years of verified volume from companies. A filter has no signal to act on.
The practical result is that phishing emails sent through SES reach inboxes at scale. They read exactly like the platform notifications employees receive every day. An employee who sees a sender inside Amazon's infrastructure has no technical indicator to question. The attack surface expands to every person who checks their inbox, with no automated gate in the way.
Case Two: The Code of Conduct Email That Steals Your Session
The second campaign, documented this week in research published by Microsoft Defender, uses a different entry point: psychology.
The phishing email arrives with a subject line about a code of conduct violation. The framing is deliberate. It creates immediate alarm. Most employees open the message before stopping to evaluate it, and the window between opening and clicking is exactly what the attackers are exploiting.
Once an employee lands on the phishing page, the attack shifts to an Adversary-in-the-Middle (AiTM) relay. The page does not collect a typed password and stop there. It sits between the employee and Microsoft's own login infrastructure, passing credentials through in real time while capturing the authenticated session token on the other side.
The consequence for security teams is direct: multi-factor authentication does not stop this attack. The employee completes MFA against Microsoft's live authentication systems. Authentication succeeds. The relay captures the valid session token and uses it independently, with no additional credentials required. The employee's account is active, the session is technically clean, and the attacker is already working inside the environment.
Microsoft's research documents this campaign operating at scale across multiple industries. The code of conduct lure is one of several emotionally calibrated triggers the group has tested systematically. Urgency accelerates the decision. Speed produces the click. The click produces the access.
What Both Attacks Have in Common
Amazon SES abuse converts trusted sending infrastructure into a phishing vehicle. AiTM phishing converts the authentication flow itself into a credential capture mechanism. In both cases, the attack's success depends entirely on one thing: a human making a specific decision in a specific moment.
Security teams have significantly reduced the volume of clearly malicious email that reaches employees. These campaigns take a different path. They move through the defenses because the defenses cannot distinguish malicious content from the legitimate traffic it mimics.
The decisive variable in both attacks is the human response. An employee who recognizes a code of conduct email as a potential lure, pauses, and reports it creates a completely different outcome than an employee who clicks and authenticates. A prepared employee makes that determination. No filter can.
What Security Teams Should Change Right Now
Four specific actions address the exposure these campaigns create.
- Train employees to recognize urgency-based lures. The code of conduct trigger works because it accelerates decision-making past the point of evaluation. An employee who has experienced this technique in a simulation, who has felt that urgency, clicked, and then been shown exactly how attackers engineer that feeling, develops a response pattern that technical filters cannot replicate. Scenario-specific simulations build exactly this kind of recognition.
- Run phishing simulations that use legitimate-looking senders. If every simulation your organization runs arrives from an obviously suspicious domain, employees develop recognition only for the scenarios that are already filtered. Simulations that originate from familiar infrastructure, use branded lures, and include emotionally charged subject lines prepare people for the attacks that are actually working today.
- Layer additional controls around session token security. The AiTM technique documented by Microsoft means that credential theft happens after successful authentication. Verify the device behind every login, require re-authentication before sensitive actions, and flag sessions that behave unusually after authentication completes.
- Make suspicious email reporting frictionless. In both attack patterns, an employee who flags an email before clicking creates an opportunity for the security team to investigate and act. Reporting buttons, clear escalation paths, and security teams that respond visibly to employee reports build the habits that catch attackers faster, across every type of attack.
The Attacks That Are Not in the Headlines
A year ago, roughly one in ten CISOs reported experiencing a sophisticated AI-powered social engineering attack at their organization. Today that number is closer to five in ten. The campaigns reaching the press represent a fraction of what is actually happening. Companies that get hit tend to keep it quiet, and the scale of what is happening behind the scenes is significantly larger than published reports suggest.
Attackers are finding the seams between what technical defenses cover and where human decisions happen. Amazon SES abuse and AiTM token theft are two documented examples from a single week of threat intelligence. Both are active. Both are producing results for attackers right now.
The question for security leaders is whether their current training, simulations, and controls reflect the attacks that are reaching employees today. The evidence from this week makes the answer clear: the playbook has changed, and most defenses have not caught up yet.
Adaptive Security builds AI-powered phishing simulations and security training built around the real-world attack patterns security teams are encountering today. Book a demo at adaptivesecurity.com.
Contents
