Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data
From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.
74
Product
Secrets Manager
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 9, 2026
- Last mentioned13h ago
Timeline
2 articles · newest firstAttacker used Qubole AWS access to steal customer secrets and data
Between October 14 and October 26 the attacker assumed customer IAM roles and copied secrets and S3 data; how the credentials were obtained is undisclosed.
74
Appears with
- AWS IAMproduct · 2
- Wizorganization · 2
- Qubolevendor · 2
- Sentraorganization · 2
- Mandiantorganization · 1
- Amazonvendor · 1
- TruffleHogproduct · 1
- Ideravendor · 1
- Amazon Web Servicesvendor · 1
- Amazon S3product · 1
- Systems Manager Parameter Storeproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.