SES is a small, but useful service that allows the management of sending and receiving emails from domains and email accounts that you own, but as an attacker with access to SES, we can use this service for information gathering and social engineering. Depending on your compromised users' access to SES and the associated setup for the different verified domains/email accounts that are registered, it can allow for some serious phishing and social engineering against both employees and clients of our target company.
Simple Email Service (SES)
Phishing
We're going to assume the account we compromised has full access to SES so that we can go over all of the attacks, but that may need to be adjusted, depending on what...
