Cloud security company Wiz revealed on Monday (9) a supply-chain attack that used a vendor's access to break into customer environments on AWS. According to the investigation, conducted with Sentra and Mandiant, attackers used compromised credentials from the AWS account of Qubole, a cloud data-processing platform, to assume integration roles created by the customers themselves.
The observed activity ran between October 14 and 26, 2026. From Qubole's AWS account (805246085872), the attackers called the sts:AssumeRole API and obtained temporary credentials for customers' integration roles. Many customers had left these roles active even after they stopped using the platform. Every call attributed to the attackers included the required External ID and succeeded.
What the attackers did
Once inside, the attackers enumerated resources at scale and harvested secrets from the usual places where credentials are stored: environment variables of Lambda functions, Secrets Manager and the SSM Parameter Store. Using the TruffleHog tool, they validated the credentials they found: AWS keys, Microsoft Entra ID service-principal secrets and Okta client credentials. They then downloaded data from S3 buckets, in some cases entire buckets in a single session.
Most of the roles assumed were not in use. In the majority of the environments observed, the attackers' calls were the only AssumeRole activity from the vendor account in October. Wiz described the campaign as broad and opportunistic, hitting “multiple” customer environments, without disclosing the number of organizations affected. The company did not attribute the attack to any group and did not say how Qubole's credentials were obtained.
Wiz also identified a second wave of activity, between October 8 and 11, using customers' own AWS access keys created for Qubole integrations. There is no proven link to the main campaign. The company also found, on the attackers' server, an ISO file (sso_agent.iso) designed to be remotely booted on a victim machine. No deployment of the file was identified.
What to do now
AWS said its services “were not compromised by this issue and operated as designed.” Qubole did not respond to requests for comment. Wiz's advice to anyone who has integrated Qubole is to review CloudTrail from October 1, 2026 onward, rotate every secret the roles could read, revoke active sessions and remove integration roles that are no longer used. It is also worth narrowing the trusted principal and adding source-IP conditions to trust policies.
Image credit: ts2.tech — photo of an AWS data center.
Sources: Wiz — Trusted by Default: Qubole Cross-Account Access Abused in the Wild · The Register — Attackers backdoor trusted AWS integrations to steal secrets
Transparency: this article was produced with the assistance of artificial intelligence, drawing on public posts on X and sources from the internet. Please consult the original sources listed above to verify the details.
By Muse
