Kaspersky has detected phishing and business email compromise (BEC) attacks that are leveraging Amazon Simple Email Service (SES) – a cloud-based email service designed for businesses and developers to send and receive high-volume marketing, notification, and transactional emails (for instance, password resets).

Because these emails are sent via a trusted service, they originate from reputable IP addresses, frequently include legitimate “.amazonses.com” identifiers. This makes phishing messages nearly indistinguishable from legitimate correspondence at a technical level. Users should treat unexpected emails with extreme caution.

The attacks are driven by the theft and exposure of credentials from Amazon Web Services (AWS). The attackers are using leaked AWS Identity and Access Management Keys – often found in public repositories, misconfigured cloud storage, and exposed configuration files. With automated tools, threat actors can identify valid keys and abuse them to send large volumes of malicious emails through legitimate infrastructure operated by Amazon.

Attackers disguise malicious links behind trusted domains such as amazonaws.com using redirects and by creating highly convincing HTML email templates. In many cases, phishing pages are hosted on infrastructure that appears legitimate, further increasing the likelihood of credential theft from victims.

One of the campaigns observed by Kaspersky in early 2026 involved emails impersonating document-signing platforms like DocuSign. Victims were prompted to review and sign documents, only to be redirected to fraudulent login pages hosted on an Amazon Web Services page designed to capture credentials.

Researchers also identified business email compromise attacks carried out via Amazon SES in which attackers impersonated employees and fabricated entire email threads with suppliers. These messages, often sent to finance departments, requested urgent payments and included PDF attachments containing only banking details – with no malicious links – making detection challenging.

“We’ve seen attackers abuse trusted platforms before – like in cases with Google Tasks and Google Forms – where scammers rely on built-in notification mechanisms to deliver phishing links from legitimate domains like @google.com, effectively bypassing email filters and exploiting user trust.

“However, the abuse of Amazon SES represents a more advanced stage of this trend: instead of merely leveraging a platform’s notification features, attackers compromise cloud credentials and gain direct control over a trusted email-sending infrastructure. This allows them to scale attacks, fully customise messages, and deliver phishing emails that are hard to distinguish from legitimate business communications,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.

National Information Technology Development Agency (NITDA) has reaffirmed that a strong and reliable digital infrastructure is fundamental to attracting investment, boosting competitiveness, and achieving sustainable growth within Nigeria’s startup ecosystem.

NITDA

This position was underscored at the Africa Fintech Foundry Ecosystem Roundtable 7.0, a virtual engagement themed “The Capital Reset: What Technologies Are Still Fundable in Africa?”

Speaking on behalf of Kashifu Inuwa, Director General of NITDA, the Special Assistant on Digital Transformation to the DG, Muhammad Aminu, emphasised that investors are increasingly drawn to startups operating in environments supported by dependable digital infrastructure and clear, predictable policy frameworks.

He explained that digital infrastructure goes far beyond basic internet access. According to him, it encompasses cloud computing systems, digital identity frameworks, payment infrastructure, data exchange platforms, interoperability standards, cybersecurity architecture, and emerging artificial intelligence technologies.

He noted that, “These foundational systems significantly lower operational barriers for startups, enabling founders to focus on innovation, customer acquisition, and scaling, rather than having to build essential infrastructure independently.”

From an investment standpoint, Aminu observed that robust digital infrastructure reduces uncertainty, lowers operational risk, enhances scalability, and considerably cuts the cost of expansion, thereby making startups more attractive to both local and international investors.

He further highlighted several ongoing government initiatives aimed at strengthening Nigeria’s digital ecosystem. These include sovereign cloud projects, data interoperability frameworks, cloud adoption policies, cybersecurity and data governance reforms, as well as the implementation of the Nigeria Startup Act.

In addition, he stressed that regulatory clarity and consistency in policy direction remain critical in attracting sustained investment into the technology sector.

Aminu also noted that NITDA is giving priority to human capital development through the 3 Million Technical Talent (3MTT) programme, describing skilled manpower as a vital component of digital infrastructure.

In conclusion, he stated that a strong, well‑structured digital infrastructure framework not only lowers the cost of innovation but also boosts investor confidence and supports the long‑term growth and expansion of Nigeria’s startup ecosystem.

Computer Professionals (Registration Council of Nigeria), also known as CPN has begun a nationwide crackdown on quackery and unlicensed practices in a bid to strengthen professional standards in the country’s information technology sector.

CPN has also  vowed tougher action against cybercrime in the country.

These were the major decisions taken at its 2026 Information Technology Professionals’ Assembly and Annual General Meeting (AGM) on Friday

Essien Eyo, president and chairman of Council of CPN, speaking at a virtual press conference, said the council would continue to enforce strict compliance with professional regulations to safeguard the integrity of Nigeria’s computing ecosystem.

He warned that the council would not tolerate unlicensed practice in the sector, stressing that regulatory enforcement would be strengthened in line with its statutory mandate.

“The Act makes it mandatory for all persons and organisations seeking to engage in computing and professional services to be registered and licensed by the council.

“It is illegal to engage in computing and professional practice without satisfying the requirement of registration and possession of a valid licence,” Eyo said.

He added that the council was determined to rid the sector of quackery and ensure that only qualified professionals are allowed to operate.

“CPN is committed to ensuring high professional ethics and standards, and we will continue to intensify efforts to eliminate quackery, arbitrary practice and lack of standards in the IT sector,” he stated.

Eyo disclosed that the 2026 IT Professionals’ Assembly, scheduled for May 13 and 14 at the NAF Conference Centre, Kado, Abuja, would serve as a key platform to advance regulatory compliance, professional development and industry collaboration.

The event, now in its 20th edition, has the theme, “Digital Resilience and Inclusion for Smart Economy,” and aligns with Nigeria’s broader digital economy and Renewed Hope Agenda.

He explained that the theme reflects the urgent need to build a secure, inclusive and resilient digital ecosystem capable of withstanding modern technological disruptions.

“In an era defined by rapid technological change, cybersecurity threats, economic disruptions and evolving digital demands, resilience ensures that digital infrastructure and institutions can withstand shocks and sustain growth,” Eyo said.

“At the same time, inclusion guarantees that no segment of society is left behind in accessing digital opportunities.”

He said the assembly would also focus on emerging digital risks, ethical technology deployment, inclusive policy frameworks and strengthening collaboration among government, industry, academia and civil society.

Eyo further noted that the event would feature the induction of new members into the computing profession and would be delivered in a hybrid format to ensure wider participation.

“The 2026 IT Professionals’ Assembly is not just an event but a strategic platform for shaping Nigeria’s digital destiny,” he said.

He confirmed that the keynote address would be delivered by Bosun Tijani, minister of Communications, Innovation and Digital Economy.

Also speaking,  Aliu Abdullahi, vice president of Council, said the establishment of CPN was a Federal Government response to the need for proper regulation of Nigeria’s growing IT sector.

He said the council’s mandate includes setting professional standards, accrediting academic programmes, conducting examinations, regulating practice, enforcing ethics and maintaining the national register of computing professionals.

Abdullahi reiterated that all individuals and organisations engaged in IT training, computing services and related activities must be duly registered and licensed by the council.

He urged media organisations to support public awareness of the council’s activities, especially the forthcoming assembly, which he described as critical to strengthening Nigeria’s digital governance and professional integrity.