Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data
From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #cloud-identity
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
1
Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
1
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
6
Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.