Kaspersky researchers uncovered a phishing scheme that utilized Amazon Simple Email Service (SES), a service which enables developers to send emails for marketing and other purposes. The threat actor was able to obtain a legitimate SES token issued during the testing of the website “250[.]earth”. By utilizing this token, the attackers were able to send legitimate looking emails using email addresses such as “noreply[@]sm[.]kaspersky[.]com”. Using Amazon SES allowed the emails to bypass most Secure Email Gateway (SEG) protections which prevent spam emails from reaching the end users inbox. The email pretends to be a “Fax notification” from Microsoft and links victims to landing pages that collect their credentials. The threat actors launching this campaign specifically target Office 365 users to ensure the users have Microsoft accounts. After further investigation, Kaspersky security experts linked this campaign to multiple known threat actors. They also discovered two phishing kits that were used in this campaign, “Iamtheboss” and “MIRCBOOT”, which made launching this campaign simple for the attackers. Kaspersky encourages users and potential victims to be cautious and double check emails that lead to websites that ask for your credentials.