Criminals are slipping phishing emails past automated security scanners inside Amazon Web Services (AWS) to establish a launching pad for attacks.
Scammers have latched onto the ability for people to use an AWS service to build and host web pages using WordPress or their own custom code. From there they can send phishing messages carrying the AWS name into corporate emails systems to both get past scanners that typically would block suspicious messages and to add greater legitimacy to fool victims, according to email security vendor Avanan.
In a report this week, researchers with Avanan – acquired last year by cybersecurity company Check Point – outlined a phishing campaign that uses AWS and unusual syntax construction in the messages to get past scanners.
"Email services that use static Allow or Block Lists to determine if email content is safe or not are not immune to these attacks," they wrote. "Essentially, these services will determine whether a website is safe or not. Amazon Web Services will always be marked as safe. It's too big and too prevalent to block."
Piggybacking on well-known brand names for phishing campaigns isn't unusual. Avanan this year has documented such efforts leveraging QuickBooks, PayPal, and Google Docs to ensure messages land in an inbox.
Now the public cloud is a vehicle and using AWS makes sense. It is the largest public cloud player, owning a th ..
Support the originator by clicking the read the rest link below.
