# Attackers backdoor trusted AWS integrations to steal secrets

- URL: https://talkfuse.com/story/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/
- Published: 2026-11-09T19:59:50+00:00
- Updated: 2026-11-09T21:03:56+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553
- Topics: Research, Science

## Key points

- Compromised Qubole-linked credentials exposed customer AWS environments.
- Attackers stole secrets and data from cloud services and S3.
- Wiz urges credential rotation and a review of AWS activity.

## Summary

Attackers used compromised credentials tied to Qubole’s AWS account to enter customer cloud environments through trusted cross-account roles. They stole secrets and data, highlighting how third-party integrations can expose customers when access permissions remain active.

Wiz researchers traced activity from 14 October, with a second IAM user involved from 18 October. The attackers probed AWS services, accessed credentials stored in Lambda, Secrets Manager and SSM Parameter Store, and took data from S3 buckets; the number of affected organisations is undisclosed. Wiz also found a separate campaign earlier in October involving Qubole integration keys, but could not confirm whether it was connected. It advises customers to rotate credentials, review CloudTrail records from 1 October and revoke active sessions.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.