Attackers used Qubole AWS credentials to raid customer clouds
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
76
Malware
TruffleHog
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 9, 2026
- Last mentioned7h ago
Timeline
2 articles · newest firstAttackers use Qubole AWS trust to steal customer secrets
Wiz says compromised Qubole IAM credentials let attackers AssumeRole into multiple customer AWS accounts starting October 14.
74
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.