Wiz: attacker used credentials from a SaaS vendor's AWS account to assume largely unused customer integration roles, harvest secrets and download S3 data across multiple AWS environments (14–26 Oct)
Wiz researchers Zack Morrow, Sean Johnstone and Benjamin Read said on 9 November 2026 that, working with Sentra and Mandiant, Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole, a cloud data processing platform, between 14 and 26 October 2026 to assume IAM roles that customers had created to trust Qubole's account.
According to Wiz, the calls came from AWS account 805246085872 using IAM user AIDA3W7DIFLYOLTK63SFS and, from 18 October, a second IAM user AIDAJYRRH5Y3A7AAJM2HW, through Mullvad VPN addresses and an OVH-hosted VPS (57.129.54[.]120); every AssumeRole request Wiz attributed to the actor included an External ID and succeeded, and most of the roles assumed were not otherwise in use.
Wiz says that once inside multiple victim environments the actor enumerated resources, read secrets from Lambda environment variables, Secrets Manager and SSM Parameter Store, used TruffleHog to validate AWS keys, Entra ID client secrets and Okta client credentials it found, and downloaded S3 data, in some cases entire buckets in a single session.
Wiz says the activity appears opportunistic, it has not tied it to any other publicly reported activity, and it also saw a separate, unlinked set of activity from 8 to 11 October using customer-owned AWS access keys it believes were created for Qubole integrations. (source: Wiz)
According to The Register, Wiz declined to say how many organisations were affected, and neither AWS nor Qubole responded to The Register's inquiries. (source: The Register)
- Product
- AWS cross-account IAM integration roles trusting the Qubole platform account (third-party trust abuse, not an AWS CVE)
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Wiz advises organisations that integrated with Qubole to review CloudTrail from 1 October 2026 onward for AssumeRole events from account 805246085872 from non-AWS addresses, any activity by IAM user AIDA3W7DIFLYOLTK63SFS, and AIDAJYRRH5Y3A7AAJM2HW from non-AWS addresses; if an integration role was assumed, rotate every secret, parameter and Lambda environment variable the role could read and revoke its active sessions. Wiz also advises deleting integration roles no longer used, narrowing trusted principals with aws:SourceIp or aws:SourceVpce conditions, and enabling S3 data events for sensitive buckets.