Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Kaspersky’s Stolen Amazon SES Token Used in Office 365 Phishing

Kaspersky’s Stolen Amazon SES Token Used in Office 365 Phishing

Kaspersky said today that a legitimate Amazon Simple Email Service (SES) token issued to a third-party contractor was recently used by threat actors behind a spear-phishing campaign targeting Office 365 users.

Amazon SES is a scalable email service designed to allow developers to send emails from any app for various use cases, including marketing and mass email communications.

Kaspersky security experts linked the phishing attempts to multiple cybercriminals who used two phishing kits in this campaign, one known as Iamtheboss and another named MIRCBOOT.

Also Read: PDPA Compliance Singapore: 10 Areas To Work On

No servers compromised

“This access token was issued to a third party contractor during the testing of the website,” Kaspersky explained in an advisory issued today, the first of its kind issued by the Russian cybersecurity firm in the last six years.

“The site is also hosted in Amazon infrastructure. Upon discovery of these phishing attacks, the SES token was immediately revoked.

“No server compromise, unauthorized database access or any other malicious activity was found at and associated services.”

The threat actors did not attempt to impersonate Kaspersky and decided to camouflage their phishing messages as missed fax notifications, redirecting potential victims to phishing landing pages designed to harvest their Microsoft credentials.

Also Read: What Does A Data Protection Officer Do? 5 Main Things

However, they used an official Kaspersky email and sent the emails from Amazon Web Services infrastructure, which likely helped them reach their targets mailboxes by easily evading most Secure Email Gateway (SEGs) protections.

“The phishing e-mails are usually arriving in the form of ‘Fax notifications’ and lure users to fake websites collecting credentials for Microsoft online services,” Kaspersky added.

“These emails have various sender addresses, including but not limited to [email protected].”

Kaspersky phishing attacks
Phishing email sample (Kaspersky)

Users warned to be cautious

Kaspersky encourages users and those targeted in these spear-phishing attacks to be cautious and remain vigilant even when asked for their credentials or other sensitive information, even if the messages asking for such info seem to come from familiar brands or email addresses

You can find detailed information on checking the sender’s identity using the email headers on Kaspersky’s blog.

In related news, Microsoft also warned in August of a highly evasive spear-phishing campaign targeting Office 365 customers in multiple waves since July 2020.

The company also said in March that attackers behind a large-scale phishing operation stole roughly 400,000 OWA and Office 365 credentials since December 2020.

Microsoft Defender ATP subscribers were also alerted in late January of an increasing number of consent phishing (aka OAuth phishing) attacks targeting remote workers.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us