Security · High impactFan score 48 · Tier B4 sources

Attackers backdoor trusted AWS integrations to steal secrets

The Register · By Jessica Lyons · 22h ago

The Brief · written from 4 sources

Attackers used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
Multiple Qubole customers were breached between October 14 and October 26, with stored secrets and data stolen from S3 buckets, according to Wiz.
Wiz published its observations and hunting guidance on 2026-11-09.

Why it matters

Customers who trusted Qubole's cross-account integration roles may have had secrets and data in their AWS accounts accessed by an unknown attacker, so teams using Qubole should check their environments for this activity.

Who’s affected

Qubole customers with AWS cross-account integrations

What to do

Review CloudTrail logs for AssumeRole activity from Qubole's AWS account during October 14–26 and hunt for suspicious access, following Wiz's guidance.
Rotate secrets and credentials stored in S3 buckets that were accessible through Qubole integration roles.

Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets. Qubole is a cloud data processing platform that uses…

Read the full story at theregister.com ↗