TI Mindmap HUB
Threat Intelligence Report

Threat Actors Using AWS WorkMail in Phishing Campaigns

📅 February 1, 2026 📰 www.rapid7.com 🔍 0 CVE(s) referenced

Threat actors are exploiting compromised AWS credentials to stealthily deploy phishing and spam campaigns via AWS WorkMail, bypassing SES controls and evading detection within victim cloud environments.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle