Attackers used Qubole AWS credentials to raid customer clouds
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
76
Product
AWS IAM
- Mentions · 7d6
- Mentions · 30d6
- All mentions9
- First seenSep 21, 2026
- Last mentioned1d ago
Timeline
9 articles · newest firstDatadog says high and critical cloud flaws quadrupled since May
Among monitored workloads, the median count rose from four in May to 16 in November, Datadog claims.
48
Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data
From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.
74
Attackers abused Qubole AWS trust to steal customer cloud data
From October 14 to October 26, attackers assumed customer roles, harvested secrets, and downloaded S3 data, including millions of files at one firm.
76
Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
From October 14 to October 26, stolen Qubole AWS credentials let an attacker assume roles in dozens of customer accounts.
74
Attacker used Qubole AWS access to steal customer secrets and data
Between October 14 and October 26 the attacker assumed customer IAM roles and copied secrets and S3 data; how the credentials were obtained is undisclosed.
74
One Bad Prompt Took Down a Company’s Salesforce: RSA’s Jim Taylor on Agent ID and Taming the 4,000 Shadow AI Agents Hiding in Your Enterprise
RSA launched Agent ID to discover, secure, and govern enterprise AI agents after finding thousands of shadow agents.
62
AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub Leak
AWS quarantined a leaked IAM key 10 seconds after Unit 42 published it to public GitHub.
56
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
Unit 42 analyzes how AWS's AWSCompromisedKeyQuarantine managed policy automatically neutralizes exposed IAM access keys, plus monitoring strategies for quarantine events.
45
Appears with
- Qubolevendor · 5
- Wizorganization · 5
- Sentraorganization · 5
- Amazon Web Servicesvendor · 4
- Amazon S3product · 4
- Mandiantorganization · 4
- Amazonvendor · 4
- Oktavendor · 2
- Palo Alto Networksvendor · 2
- GitHub secret scanningproduct · 2
- Microsoftvendor · 2
- GitHubvendor · 2
- Secrets Managerproduct · 2
- Microsoft Entra IDproduct · 2
- Salesforcevendor · 1
- Gartnerorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.