PoisonSeeds AWS Phishing Email from awsservices@presby.edu

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.