Supply-chain attack through Qubole: stolen credentials from the vendor's AWS account were used to assume customer integration roles and steal secrets and S3 data, Oct 14 to 26

research (Wiz CIRT with Sentra and Mandiant, published Nov 9, 2026); how the attacker obtained the Qubole-account IAM credentials is not disclosed; no Qubole or Idera statement found at publication2026-11-09

Supply-chain attack through Qubole: stolen credentials from the vendor's AWS account were used to assume customer integration roles and steal secrets and S3 data, Oct 14 to 26

Who should look: any organization that ever connected Qubole to AWS, even if it no longer uses it. Wiz says to review CloudTrail from Oct 1, 2026 in every account holding an integration role.
Why the controls didn't stop it: the External ID isn't a secret (it's logged in plaintext in CloudTrail and often stored in infrastructure-as-code), and the trust policies named the vendor account's :root principal without a source-network condition. Wiz says an aws:SourceIp condition alone would have blocked every role assumption it observed.
If a role was assumed: rotate every secret, parameter and Lambda environment variable it could read, and revoke active role sessions; rotating a credential does not end sessions already issued.
See the companion hunt and tip items for the CloudTrail queries and trust-policy fixes.

Sources: Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild (Nov 9, 2026) · AWS IAM User Guide: access to AWS accounts owned by third parties (External ID guidance)