# Trusted by Default: Qubole Cross-Account Access Abused in the Wild

DevFeed: [Trusted by Default: Qubole Cross-Account Access Abused in the Wild](<https://devfeed.tech/articles/trusted-by-default-qubole-cross-account-access-abused-in-the-wild-123993.md>)

Original publisher: [Read original article](<https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild>)

Author: Benjamin Read

Published: 2026-11-09T14:56:32Z

Content type: news

Language: en

Sources: [Wiz](<https://devfeed.tech/sources/wiz-blog-rss-feed.md>)

Topics: [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [identity and access management](<https://devfeed.tech/topics/identity-and-access-management.md>), [AWS Security Token Service](<https://devfeed.tech/topics/aws-security-token-service.md>), [Threat monitoring](<https://devfeed.tech/topics/threat-monitoring.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Security](<https://devfeed.tech/topics/security.md>), [Secrets Management](<https://devfeed.tech/topics/secrets-management.md>), [network security](<https://devfeed.tech/topics/network-security.md>), [okta](<https://devfeed.tech/topics/okta.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [actions](<https://devfeed.tech/tags/actions.md>), [actor](<https://devfeed.tech/tags/actor.md>), [addition](<https://devfeed.tech/tags/addition.md>), [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-threat](<https://devfeed.tech/tags/ai-threat.md>), [aws](<https://devfeed.tech/tags/aws.md>), [cirt](<https://devfeed.tech/tags/cirt.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cross](<https://devfeed.tech/tags/cross.md>), [customer](<https://devfeed.tech/tags/customer.md>), [environments](<https://devfeed.tech/tags/environments.md>), [here-s](<https://devfeed.tech/tags/here-s.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [iam](<https://devfeed.tech/tags/iam.md>), [integration](<https://devfeed.tech/tags/integration.md>), [research](<https://devfeed.tech/tags/research.md>), [roles](<https://devfeed.tech/tags/roles.md>), [threat-intel](<https://devfeed.tech/tags/threat-intel.md>), [used](<https://devfeed.tech/tags/used.md>), [wild](<https://devfeed.tech/tags/wild.md>)

## AI overview

From October 14-26, 2026, an actor used IAM credentials from an AWS account associated with Qubole to assume customer integration roles; the observed requests included External IDs and succeeded. In affected environments, the actor enumerated cloud resources, read secrets and Lambda configuration, tested discovered credentials, and downloaded accessible S3 objects. Wiz recommends reviewing CloudTrail from October 1 onward for the specified account, principal IDs, unusual source networks and indicators, then tracing each role session and rotating exposed credentials while revoking active sessions. For prevention, inventory and remove unused vendor trusts, narrow trusted principals and network sources, treat External IDs as non-secret, limit role permissions, and enable S3 data events or access logs for sensitive buckets. The article notes that management events do not show S3 object reads. A separate October 8-11 activity involving customer-owned keys is not linked to the role-abuse campaign; the ISO's deployment or use could not be confirmed.

## Source excerpt

A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.