# Trusted by Default: Qubole Cross-Account Access Abused in the Wild

Source: [Wiz Blog | RSS feed](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) · 2026-11-09 · Security
Page: https://themorning.dev/story/trusted-by-default-qubole-cross-account-access-abused-in-the-wild-f3f3d2a78cd5b234
Kind: security · Impact: high

## In brief

- A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
- Wiz reported its observations of the activity and published guidance on how to hunt for it.

## Why it matters

Customers whose AWS accounts trust Qubole integration roles may have been accessed through that trust, so unexpected role assumptions in their accounts should be checked.

## What to do

- Hunt for unexpected role assumptions from Qubole's AWS account in your AWS logs, following the hunting guidance in the Wiz blog post.

## Timeline

- 2026-11-09: Wiz publishes report on abuse of Qubole cross-account access

## Coverage

- [Trusted by Default: Qubole Cross-Account Access Abused in the Wild](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) — Wiz Blog | RSS feed, 2026-11-09

Tags: aws, iam, cloud-security, supply-chain, qubole

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev