Attackers Abuse Qubole’s AWS Trust Relationships to Steal Customer Secrets and S3 Data

An unidentified attacker used IAM credentials from an AWS account associated with Qubole to assume trusted integration roles across multiple customers’ AWS environments between October 14 and October 26, 2026, according to Wiz. The attacker enumerated resources, harvested secrets, validated stolen credentials with TruffleHog, and exfiltrated accessible S3 data. Stolen secrets included AWS access keys, Microsoft Entra ID client secrets, and Okta client credentials. Many exploited roles were otherwise inactive but retained cross-account trust in Qubole; every attributed role-assumption request included an accepted External ID, demonstrating that this control alone did not prevent the abuse.

Wiz also identified separate activity between October 8 and October 11 involving customer-owned AWS keys believed to support Qubole integrations, but did not establish a link to the cross-account campaign. Researchers found a potentially malicious bootable Linux ISO on attacker infrastructure, without confirming its deployment or use. The initial credential theft mechanism, revocation status, and whether the activity had stopped were not disclosed. Defenders should review CloudTrail logs from October 1 onward, remove unused vendor trust relationships, restrict trusted principals and source networks, revoke compromised sessions, rotate exposed secrets, and enable comprehensive logging.