Reading view

There are new articles available, click to refresh the page.

The U.S. Treasury’s plan to double the scale of its Treasury buyback operations is expected to take effect on Sep. 9; XRP is poised to break through the $1.70 mark, with holders potentially earning $10,000 daily

The U.S. Treasury Department fully launched its government debt buyback program on Sep. 7, boosting market expectations regarding the near-term liquidity of Bitcoin and XRP. The program has a weekly cap of $14.5 billion. According to the blockchain media outlet…

Amazon to acquire DuckLabs, adding the team behind DuckDB amid broader shakeup in cloud data

DuckDB creators Mark Raasveldt, left, and Hannes Mühleisen. (DuckLabs Photo)

Amazon has agreed to acquire DuckLabs, the company behind DuckDB, the fast-growing open-source database that has become a favorite of developers looking to analyze large amounts of data without the cost and setup of a cloud data warehouse.

Employees of DuckLabs will join Amazon Web Services, including co-founders and DuckDB creators Hannes Mühleisen and Mark Raasveldt, who will continue leading the team and setting the project’s technical direction. They will remain based in Amsterdam, where the team will continue developing DuckDB and related projects.

Amazon says it is not acquiring the DuckDB open-source project itself. DuckDB will remain free and open source under the MIT license, overseen by the nonprofit DuckDB Foundation, as will the related DuckLake and Quack projects, according to DuckLabs.

Financial terms were not disclosed. Amazon said it has signed a definitive agreement and expects the acquisition to close shortly. DuckLabs said it expects to become part of AWS in early September.

Larger shifts in cloud data

The deal fits Amazon’s broader push to turn S3, its flagship cloud storage service, into a place where customers analyze data rather than just store it. It gives Amazon a team experienced in building fast, lightweight analytics software that runs directly against data sitting in cloud storage.

The move comes as the data industry shifts toward keeping information in open formats in cloud storage, where it can be queried directly rather than loaded into a separate warehouse.

The shift puts pressure on companies like Snowflake and Databricks, which sell the compute and governance layer on top of stored data. Both are major AWS partners as well as competitors, with large numbers of customers running on Amazon’s cloud.

AI has raised the stakes, driving up both the volume of data companies keep in the cloud and the cost of analyzing it. Amazon says DuckDB is a natural fit for AI agents, which query data much the way people do, poking and experimenting with small sets before deciding what they want.

“DuckDB ends up being naturally optimized for AI agents to use,” wrote Mai-Lan Tomsen Bukovec, the AWS VP who leads its cloud data services, in a post about the acquisition.

DuckLabs said it has worked closely with AWS in recent years, including on DuckDB support for Amazon’s S3 Tables and SageMaker Lakehouse.

“DuckDB is an incredible open source project with an amazing community; it is broadly used and very much loved by S3 customers today,” said Andy Warfield, an AWS vice president and distinguished engineer, in a press release announcing the deal.

‘That’s Amazon’s playbook’

One of the companies watching closely is in Seattle. MotherDuck, which sells a cloud service built on DuckDB, was founded in partnership with the DuckLabs team and has worked with it closely for four years. Three of its engineers are among the top 10 outside contributors to the DuckDB project.

MotherDuck CEO Jordan Tigani. (LinkedIn Photo)

In a blog post Wednesday, MotherDuck CEO Jordan Tigani said Amazon is following a familiar pattern. “That’s Amazon’s playbook, after all: wait until an open source project gets big enough, then launch it as a service,” wrote Tigani, who helped start Google’s BigQuery and spent a decade there before co-founding MotherDuck in 2022.

He expects Amazon to do exactly that with DuckDB: “After all, they’re not acquiring Duck Labs just because they love open source,” he wrote. “We welcome the competition.”

He said the deal is likely to be good for DuckDB, because Amazon has a financial reason to keep the project open and healthy. “If DuckDB becomes the standard, it is going to drive a lot more compute on their infrastructure, which is where they make their money,” he wrote.

Tigani said DuckLabs is being kept as a wholly owned subsidiary with its organization intact, and that the DuckDB Foundation has “iron clad control over the DuckDB IP.”


MotherDuck also said it is now offering enterprise support for DuckDB — which it had previously steered clear of to avoid competing with DuckLabs. Tigani said the company has Mühleisen and Raasveldt’s “explicit blessing” to take it on now that they are joining Amazon.

Five years, no venture capital

DuckLabs was founded a little more than five years ago as a long-term home for the DuckDB development team. The company turned down venture capital, stayed owned by its founders and employees, and grew to more than 30 people in Amsterdam, funding itself through support and feature-development contracts.

In a blog post, Mühleisen and Raasveldt wrote that they had come to worry DuckDB’s growth would outpace their ability to support it, and that their small company “could become a bottleneck for the project.” Building a larger sales and operations organization, they wrote, would have pulled the team away from the technical work that made DuckDB successful.

Nine days before the acquisition was announced, Mühleisen and Raasveldt published a preview of DuckDB 2.0, due this fall, declaring that the release “kicks off the year of DuckDB as a server.” It adds Quack, which lets one DuckDB instance serve data to others over a network, along with work aimed at speeding up queries against data held in object storage such as S3.

DuckLabs said the DuckDB Foundation will add a technical advisory board, giving leading community members input on the project’s technical direction. The company also plans to let DuckDB run extensions signed by outside developers and organizations.

How legitimate cloud platforms enable phishers to bypass MFA

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently.

The cloud as a safe haven for phishers

Threat actors select platform-as-a-service (PaaS) offerings and distributed cloud environments to host phishing sites for much the same reasons legitimate software developers do:

  • Inherent trust and reputation. Phishing pages hosted on reputable platforms appear trustworthy, reducing suspicion among potential victims.
  • Most platforms offer generous free-tier developer plans. The onboarding process takes minutes and rarely requires Know Your Customer (KYC) identity verification. This enables a single operator to create hundreds of malicious accounts.
  • Evasion and anonymity. Attackers leverage native security features to obscure their true origin server IP address behind a CDN, which complicates detection for security vendors.

Additionally, these platforms allocate shared subdomains hosting millions of legitimate projects and websites. Security teams cannot simply block the parent domain or its subdomains without inflicting collateral damage on bona fide users – a limitation that malicious actors take advantage of. To counter this tactic, security vendors must advance content-based analysis methodologies.

Multi-stage AitM attack

Consider a modern AitM phishing campaign that leverages Cloudflare Workers, a widely adopted cloud platform. The attackers execute the operation through multiple HTML pages distributed across a compromised website and the cloud platform. Each page serves a specific function: harvesting target email addresses, initializing the reverse-proxy infrastructure, or spoofing the login form to capture multi-factor authentication (MFA) sessions.

Stage 1. Contact harvesting and network monitoring evasion

The attack typically begins with a phishing email that uses a plausible pretext – such as a request from a coworker to review documents – to entice the target into clicking a malicious link.

Upon clicking the link, the user is redirected to a fake CAPTCHA landing page hosted on a compromised legitimate website. This specific campaign used the https://t[REDACTED]e.com website, but any other variations are possible. In this scenario, the compromised page served as a disposable relay — vendor detection mechanisms typically block phishing links delivered directly via email much faster — to prevent the early discovery of the core phishing content hosted on Cloudflare.

If the user entered their email address and clicked Continue, the pseudo-CAPTCHA marked them as a human user and initiated a redirect. The primary objective of this stage is to harvest target email addresses, filter out bots, and route legitimate users to a subdomain of workers.dev. Such subdomains are generated automatically and free of charge by Cloudflare Workers. The victim’s email address was embedded in the URL hash (the part of the URL following the # character), allowing the page at [REDACTED].workers.dev to extract the email without issuing a request to the attacker’s server, thereby avoiding detection.

Stage 2. Initializing a transparent proxy

The user’s browser then loaded a [REDACTED].workers.dev page with #user@business.com at the end of the URL. At this point, the page presented the victim with a genuine CAPTCHA challenge. This step ensured that an actual user was interacting with the page rather than a security sandbox.

Another CAPTCHA, this time a legitimate one

Another CAPTCHA, this time a legitimate one

Once the user successfully completed the challenge, a service worker was registered in their browser. This is a special JavaScript file capable of running in the background and intercepting all network requests generated by the current tab. As this type of script was designed as a core component of progressive web apps (PWAs) to optimize load times and support offline functionality, browsers treat service workers as standard site feature and execute them without prompting for user consent as long as the website uses an HTTPS connection.

The attackers leveraged the service worker to deploy Ultraviolet, a legitimate open-source web proxy library, to dynamically rewrite all links and forms on the page. This forced every outgoing request – including those for Microsoft login credentials – to route through the attackers’ server rather than directly to the legitimate services.

Immediately upon loading, the page extracted the victim’s email address from the URL hash and stored it in the browser’s sessionStorage property so it would not be overwritten when the CAPTCHA loaded. This step also allowed the script to pre-fill the username field in the form automatically. A pre-populated login field enhanced the page’s credibility and bolstered user trust. Once the CAPTCHA was passed, the malicious script constructed a redirect URL for the third stage, appending the email retrieved from sessionStorage back to the hash. By passing the email via the URL hash across three consecutive stages, the attackers successfully kept it hidden from network attack detection systems.

Registering a service worker to intercept traffic

Registering a service worker to intercept traffic

Establishing a transparent proxy via an external library

Establishing a transparent proxy via an external library

Stage 3. Session hijacking and browser window spoofing

The final stage unfolded on a third page, combining adversary-in-the-middle (AitM) traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. BitB attacks operate by rendering a block inside a legitimate webpage that visually mimics a native browser pop-up window.

In this case, the script hosted on the attacker’s page generated a pop-up visually identical to a native browser window, complete with window controls and a spoofed address bar showing a trusted Microsoft URL. Within this simulated window, an iframe loaded the authentic login interface, routed dynamically through the service worker reverse proxy created in Stage 2. When the victim entered their credentials and MFA code into the BitB window, the proxy script intercepted both the credentials and the session tokens. Combining BitB with AitM significantly increases the threat: BitB provides a convincing, trusted visual wrapper (displaying a legitimate URL and branding), while the hidden AitM proxy quietly handles traffic interception and session hijacking behind the scenes.

Upon successful login, the proxy instructs the interface to close the pop-up and redirect the victim to a generic system error page, such as SessionExpired. This minimizes suspicion: the victim assumes a technical glitch occurred and attempts to log in again, unaware that the attacker already has full access to the session.

Cloud platform phishing attack statistics

We analyzed phishing URLs hosted across popular cloud platforms – including Cloudflare, Netlify, and GitHub Pages – over a 12-month period spanning August 2025 to July 2026. The data below outlines trends in unique third-level domains exploited to deliver phishing content. In total, our security solutions blocked 224,984 unique third-level domains on cloud and decentralized services used in phishing attacks within that timeframe.

Number of unique third-level domains
(download)

Based on this telemetry, we compiled a list of the TOP 10 cloud domains most frequently abused in phishing campaigns over the specified period.

Number of phishing links

Unsurprisingly, Cloudflare and Vercel emerged as the undisputed leaders: both offer free tiers, automated SSL certificate issuance, and global CDNs. GitHub Pages ranked third. The widespread legitimate use of the github.io domain complicates bulk blocking efforts, as security teams risk limiting access to non-malicious projects.

Decentralized networks also warrant close attention – we posted on this subject in 2023. The ipfs.io and dweb.link domains function as IPFS gateways. The principal risk associated with these platforms is content persistence: even if a specific gateway gets blocked, the phishing page remains accessible via alternative nodes across the network.

The visual website builders Wix and Webflow also ranked among the TOP 10 (eighth and ninth, respectively). These platforms allow low-skilled individuals to build phishing pages rapidly without advanced coding expertise, which significantly lowers the barrier to entry for less capable malicious actors.

 

Domain Number of phishing links Platform
1 pages.dev 24.9% Cloudflare Pages
2 vercel.app 13.8% Vercel
3 github.io 13.7% GitHub Pages
4 netlify.app 10.0% Netlify
5 dweb.link 7.8% IPFS gateway
6 ipfs.io 5.3% IPFS (InterPlanetary File System)
7 workers.dev 2.5% Cloudflare Workers
8 wixstudio.com 1.9% Wix Studio
9 webflow.io 1.0% Webflow
10 azurewebsites.net 1.0% Microsoft Azure
Other 17.9%

In total, we identified and neutralized over 390,000 phishing pages hosted across legitimate cloud platforms and decentralized networks (IPFS) over the past 12 months. This data confirms that threat actors actively exploit the implicit trust associated with legitimate PaaS providers (such as Cloudflare Workers, Vercel, Netlify, and GitHub Pages) and IPFS gateways. High domain reputation, generous free tiers, and built-in evasion capabilities enable phishers to deploy multi-stage AitM attacks designed to hijack MFA sessions.

Recommendations

Traditional security controls, such as relying on HTTPS lock icons or reputation-based domain denylists, are inadequate against these attacks. The cloud provider’s apex domain maintains a positive reputation score, while attackers generate malicious subdomains programmatically and at scale.

Effective defense against these threats calls for a layered security posture:

  • Exercise caution with unexpected requests, even if they are served from reputable domains or secured with valid SSL/TLS certificates.
  • Treat any CAPTCHA interface requiring personal data input as a possible scam. Legitimate CAPTCHA challenges rarely request personally identifiable information, such as email addresses.
  • Inspect the URL in the address bar at the very top of the browser window. In BitB attacks, threat actors can render a fake browser pop-up displaying any target URL, even a legitimate one. However, the true address bar – located at the top of the main browser window alongside native navigation controls (Back, Forward, Refresh) – will continue to display the actual attacker-controlled domain.
  • Avoid entering credentials in pop-ups you did not expect to see. If a login or MFA form appears without your explicit action, close the tab immediately. Navigate to the intended service manually by entering its address directly into the browser.
  • Additional protection can be provided by Kaspersky Secure Mail Gateway for enterprise environments and Kaspersky Premium for personal correspondence. These robust email security solutions neutralize phishing links at the delivery stage before they reach the inbox.

Amazon tops $3 trillion and Microsoft surges as Wall Street sets aside AI spending fears, for now

GeekWire Illustration

Microsoft and Amazon both saw their stocks surge again Monday, riding a post-earnings tech wave across the stock market that pushed Amazon past $3 trillion in value for the first time.

The gains follow earnings reports last week in which both companies’ cloud platforms exceeded expectations. Microsoft said Azure grew 43%, passing $100 billion in annual revenue for the first time. Amazon said AWS grew 37%, its fastest pace in 18 quarters.

Microsoft and Amazon are now the world’s fourth and fifth most valuable companies, respectively. The three ahead of them (Nvidia, Alphabet and Apple) are all headquartered in the Bay Area, although each has sizeable engineering centers in the Seattle region.

Amazon rose 4.6% in intraday trading to $284.15 as of publication time, after touching an all-time high of $287.20 earlier in the session, giving it a market value of $3.06 trillion.

Microsoft climbed 5.2% to $488.97, worth $3.63 trillion. Its rally began Thursday, when it added nearly $450 billion in market value, the largest one-day gain by any company on record.

The rallies came despite AI spending plans that have unsettled investors for much of the year. Microsoft went into earnings near a one-year low, after a $357 billion wipeout to start the year.

It’s all still coming at a huge cost. Microsoft spent a record $41 billion on capital projects last quarter and told investors to expect more than $50 billion in the current quarter. Amazon raised its 2026 forecast to about $220 billion from $200 billion, citing rising memory chip prices.

In one sign of the impact of the spending, Microsoft’s free cash flow fell 23% last quarter. Amazon’s free cash flow turned negative for the first time since 2023.

But cloud growth and other signs of demand for AI seem to have appeased investors for now.

Amazon CEO Andy Jassy told investors the spending reflects unmet demand: “Even at that amount, we will still not have enough capacity to meet all the demand we have in 2026, and I believe this dynamic will also be true in 2027 too. In fact, the demand we already have for 2028 is striking.”

The gains come as both companies operate with fewer people. Amazon confirmed 16,000 more corporate job cuts in January, bringing the total to 30,000 since October, along with more recent reductions in its robotics and artificial general intelligence groups.

Microsoft cut 4,800 jobs in July, revamping its salesforce and overhauling Xbox.

Amazon’s next big business, Satya Nadella’s DIY app, and a VC’s rallying cry for Seattle tech

This week on the GeekWire podcast: Microsoft and Amazon both reported quarterly numbers, and both stocks rose on cloud results that beat expectations. Is all that AI spending paying off? And in related news, Microsoft sees a rare annual headcount decline, hitting product R&D hardest. 

Plus: Satya Nadella builds a Power BI dashboard out of an analyst’s research report, and touts it on the earnings call to make a bigger point. Jeff Bezos names Amazon’s chips business as the long-awaited fourth pillar. And AI House managing director Jacob Colker delivers a much-needed pep talk for Seattle tech, calling on the region to recognize and build on its strengths. 

Related stories and links

Microsoft and Amazon earnings

Amazon’s fourth pillar

A rallying cry for Seattle tech

The Washington tech ecosystem

Subscribe to GeekWire in Apple Podcasts, Spotify, or wherever you listen.

AWS is ‘booming,’ but Amazon’s free cash flow turns negative on record AI spending

AWS CMO Julia White, left, and CEO Matt Garman at an event in April. (GeekWire File Photo / Todd Bishop)

Amazon Web Services revenue grew 37% last quarter, its fastest pace since the end of 2021, but the company is spending so much on data centers and infrastructure to fuel that growth that its free cash flow for the past 12 months turned negative for the first time since 2023.

Overall, the tech giant reported $200.6 billion in revenue for the second quarter, up 20%, with operating income of $27.5 billion, up 43%. That beat Wall Street’s expectations of about $196.4 billion in revenue, and topped the high end of Amazon’s own guidance.

Profits were $62.6 billion, or $5.75 per share. However, that included $53.4 billion in pre-tax gains, primarily on Amazon’s investment in Anthropic, which inflated the bottom line. Excluding those gains, EPS would have been about $1.95, above analyst expectations of $1.82.

Amazon shares rose more than 8% in after-hours trading following the report.

AWS revenue reached $42.2 billion in the quarter, a $169 billion annualized run rate. Operating income in the cloud division rose 64% to $16.6 billion, lifting AWS operating margin to 39.4% from 32.9% a year ago — evidence that the AI buildout is starting to convert into profit, not just revenue.

“AWS is booming,” CEO Andy Jassy said in the release, adding that the company’s AI and chips businesses “each eclipsed run rates of more than $25 billion.” The chips business, which Jeff Bezos called the next pillar of the company this week, was at a $20 billion run rate three months ago.

Amazon’s operations generated $161.4 billion over the past 12 months, but the company spent a net $169 billion on property and equipment — up $66.1 billion from a year earlier, an increase Amazon attributed primarily to AI investments — leaving a shortfall of $7.6 billion in free cash flow.

A year earlier, it had $18.2 billion left over for the prior 12 months, by comparison.

Free cash flow is what’s left after a company covers its operating costs and pays for things like data centers and warehouses. It’s an important measure of financial health, which investors watch closely because it shows how much cash a business actually creates after paying for its own growth.

Update: Amazon raised its capital spending forecast on its earnings call. Jassy said the company now expects to spend about $220 billion in cash capex this year, up from the roughly $200 billion it projected earlier, attributing the increase to the higher cost of memory chips.

He addressed the cash flow squeeze directly, framing it as a matter of timing. Data centers require capital about two years before servers can be installed and start generating revenue, he said, but once open, they can be monetized for more than 30 years without repeating that upfront cost.

Servers and networking equipment run on a shorter cycle, purchased a few months before going into service. Those take a little under three years to break even, Jassy said, against a useful life of at least five to six years.

He said most of Amazon’s AI capacity is now contracted for terms of five years or longer.

“We’ll spend a lot of capex and encounter free cash flow headwinds until these data centers come online, can be monetized, and we get a few years into these servers being utilized,” Jassy said.

Other notes from Amazon’s earnings release:

Online store sales rose 15% to $70.4 billion, up from 10% growth in the same quarter a year ago. It remains Amazon’s largest single revenue line at about 35% of total revenue, and it is the line most directly affected by the decision to move Prime Day into June, into the second quarter. Last year, the annual online sales event took place in the third quarter.

Advertising revenue rose 26% to $19.8 billion, up from 22% growth in the same quarter a year ago. It has generated about $76 billion over the past 12 months, making it one of Amazon’s fastest-growing businesses. Prime Day lifted this line as well, because the event drives a surge in spending by sellers and brands competing for placement.

Third-party seller services revenue, which includes commissions and fulfillment and shipping fees Amazon charges independent merchants, rose 16% to $46.8 billion, up from 10% growth in the same quarter a year ago. Independent sellers accounted for 61% of units sold in Amazon’s stores, roughly flat with recent quarters. Prime Day boosted this line as well.

Subscription services, which includes Prime memberships, grew 12% to $13.7 billion. The line has grown between 10% and 12% every quarter for the past year and a half. Analysts have been expecting a Prime price increase, which has not yet materialized.

Microsoft Azure tops $100B in annual revenue as record AI spending cuts into cash flow

GeekWire File Photo

Microsoft’s Azure cloud business grew 43% last quarter, blowing past the company’s own forecast and surpassing $100 billion in annual revenue for the first time, providing fresh evidence of the potential for artificial intelligence to fuel new growth for the tech giant.

The company’s results for its fiscal fourth quarter also showed the price of that growth: capital spending hit a record $41 billion, largely to support the company’s AI buildout, and free cash flow sank 23% even as operating profits jumped 18%.

And in a new twist, Microsoft shares rose more than 5% in after-hours trading, in contrast with the recent pattern in which the company’s strong results were met with selloffs that pushed its stock near a one-year low.

Companywide results: Overall, Microsoft reported revenue of $90 billion for the quarter, up 18% from a year ago, and net income of $35.8 billion, up 31%. Analysts had expected $87.7 billion in revenue, a figure that was already at the top of Microsoft’s own guidance range.

Microsoft’s adjusted earnings of $4.74 per share topped the $4.24 that analysts expected, according to Yahoo Finance. That included a $3.2 billion gain on Microsoft’s investment in Anthropic, part of a 27-cent benefit from one-time items. Even excluding those items, the company said, it exceeded expectations across revenue, operating income and earnings per share.

Microsoft 365 Copilot surpassed 30 million paid seats, up from 20 million last quarter. That’s still less than 7% of the roughly 450 million commercial Microsoft 365 seats, a gap that has drawn investor skepticism all year.

Microsoft’s backlog grew 84% to $678 billion. Known as remaining performance obligation, or RPO, it’s the value of contracts that customers have signed but that Microsoft hasn’t delivered on yet, basically the business Microsoft has already locked in but has yet to record as revenue.

Investors have been worried for a year that too much of it came from a single customer, OpenAI. Microsoft said all of the $51 billion increase over the prior quarter came from customers other than the big AI model companies. Setting OpenAI aside, the backlog still grew 25%.

Windows OEM and Devices revenue declined 7%, hurt by slower PC demand and a tough comparison with last year’s Windows 10 upgrade wave. The decline would have been steeper, but PC makers built more machines to get ahead of rising memory prices, and Microsoft collects its Windows fee when a PC is built rather than when it’s sold.

Xbox content and services revenue fell 10% and Xbox hardware fell 13%. Microsoft also wrote down the value of unspecified Xbox assets. The company grouped that charge with severance costs and lower-than-expected costs from its retirement program — a net $500 million hit to operating income — and declined to say how much of it was Xbox or what was written down.

Amazon earnings preview: Wall Street looks for more cloud growth as AI spending hits a record

Amazon reports quarterly earnings Thursday afternoon, facing the same test as every other big tech company right now: whether it’s generating enough business to justify its massive AI spending.

Wall Street expects revenue of about $196.4 billion, up 17% from a year ago, and earnings of $1.82 per share. That’s essentially the midpoint of Amazon’s own forecast for the second quarter.

Part of that growth is due to the calendar. Prime Day ran June 23-26 this year, during the second quarter in the U.S. and most large markets. Last year it ran July 8-11, in the third quarter. That gives Amazon’s retail numbers a boost this time that the year-ago quarter didn’t have.

Another factor is the cloud. AWS grew revenue 28% last quarter, its fastest rate in nearly four years, and analysts expect the acceleration to continue with revenue of roughly $40.5 billion for the second quarter, up 31%, according to Zacks Consensus Estimates.

The company plans a record $200 billion in capital expenditures this year, nearly all of it for data centers, servers and chips to support increased capacity for training and running AI models.

Amazon is making those investments based in part on demand from big AI companies including OpenAI and Anthropic, which have signed commitments to AWS worth $138 billion and more than $100 billion, respectively, for the coming years.

“We’re not investing approximately $200 billion in capex in 2026 on a hunch,” CEO Andy Jassy wrote in his April shareholder letter.

In the meantime, the spending is absorbing nearly all of the cash from Amazon’s operations. Free cash flow fell to $1.2 billion over the past 12 months, from $25.9 billion a year earlier.

Investors seem to be losing patience with that tradeoff overall. Google parent Alphabet beat expectations last week and its stock fell anyway, after raising its own capital spending forecast to as much as $205 billion for the year. Microsoft reports earnings Wednesday afternoon.

One difference for Amazon is its custom chip business — Graviton, Trainium and Nitro — which passed a $20 billion annual revenue run rate last quarter. Jeff Bezos said this week that it’s becoming a fourth pillar of the company, alongside Marketplace, Prime and AWS.

The company is overhauling its approach to AI model development. Business Insider reported this week that Amazon is winding down most of its in-house Nova models and concentrating engineers on a new frontier model effort, with a new flagship model expected at re:Invent this fall.

Amazon cut jobs in its AGI organization last week and confirmed that it’s closing its San Francisco AI site, while saying its frontier model research would continue.

At the same time, AWS is spending to help other companies deploy AI, committing $1 billion at the end of June to embed its own engineers with enterprise customers building agentic systems, following similar moves by OpenAI and Anthropic.

Check back with GeekWire for coverage on Thursday afternoon.

Jeff Bezos says this business is becoming Amazon’s next ‘pillar’

Amazon’s next pillar could be built on a foundation of silicon.

In a new interview with Fortune, Amazon founder and Executive Chair Jeff Bezos says the company’s custom chip business is on track to become one of Amazon’s most durable businesses, placing it alongside Marketplace, Prime, and Amazon Web Services as a core pillar of the company.

“A few of our offerings have become durable pillars, things like Marketplace and Prime and AWS,” Bezos told Fortune. “What I see right now is that our chips business, our silicon business, is lining up to be our next pillar.”

The comments offer one of Bezos’ clearest public endorsements yet of Amazon’s push to design its own chips for artificial intelligence, an increasingly important strategy as demand for AI computing soars and companies look for alternatives to Nvidia’s dominant processors.

More than a decade of investment

Amazon has invested heavily in custom silicon through Annapurna Labs, the Israeli chip startup it acquired in 2015. The company now develops its own AI chips under the Trainium and Inferentia brands, designed to train and run large language models while reducing costs for customers using Amazon Web Services.

AWS has positioned the chips as a lower-cost alternative for AI developers. AWS has positioned the chips as a lower-cost alternative for AI developers. Anthropic trains and runs its Claude models on Trainium, and OpenAI has committed to consume about 2 gigawatts of Trainium capacity, ramping in 2027.

The company disclosed revenue for its in-house data center chips for the first time earlier this year, and since then its Trainium, Graviton, and Nitro chips have grown to a combined annual run rate of more than $20 billion. Amazon has been pouring billions of dollars into AI infrastructure, including new data centers and custom networking hardware.

Amazon CEO Andy Jassy has repeatedly argued that demand for AI computing will remain strong for years, making investments in chips, servers, networking equipment, and power generation essential to the company’s long-term growth.

In an earnings release earlier this year, Jassy signaled plans to pour a record $200 billion in capital expenditures across Amazon in 2026, citing “seminal opportunities like AI, chips, robotics, and low earth orbit satellites.”

The real potential for Amazon’s chips business could come in going beyond the walls of its own data centers. Jassy wrote in his annual letter to shareholders this year that it’s “quite possible” Amazon will sell racks of its internally developed chips to third parties in the future.

Amazon’s fourth pillar?

This discussion about Amazon’s “pillars” goes back to Bezos’ 2014 letter to shareholders, where he described four characteristics of what he called a “dreamy” business: “Customers love it, it can grow to very large size, it has strong returns on capital, and it’s durable in time — with the potential to endure for decades.”

AWS, Marketplace, and Prime are considered the first three pillars. The question of what could become Amazon’s “fourth pillar” has been debated for more than a decade, with areas including shipping and logistics and Alexa cited as contenders in the past.

The company’s big bet on silicon also was emphasized by Jassy in the Fortune piece. He told the magazine that chips are often the key to computing. “The growth in AI has been so significant, but we have a chips business that we built over the last decade here that is growing very quickly,” he said.

The profile appeared alongside Fortune’s release of its 2026 Global 500 ranking, which placed Amazon at No. 1 for the first time, ending Walmart’s 12-year run as the world’s largest company by revenue after Amazon surpassed $700 billion in annual sales, as reported previously.

Walmart fell to No. 2, followed by State Grid of China, UnitedHealth Group, and Saudi Aramco. The magazine reports that Amazon is on pace to be the first trillion dollar company by revenue.

Amazon reports Q2 2026 earnings on Thursday afternoon. Check back with GeekWire for coverage.

❌