Hackers exploit trusted AWS access to breach multiple cloud environments

Attackers compromised IAM users within Qubole, a cloud data platform, and leveraged trusted role-assumption relationships to pivot into dozens of customer AWS accounts — a classic supply chain trust abuse. The root failure was the existence of overly permissive cross-account IAM roles that allowed a compromised vendor identity to reach customer environments without additional verification. Tools like TruffleHog were used to harvest embedded secrets from accessible resources, amplifying the damage once initial access was gained. This incident illustrates how third-party cloud integrations can silently expand your attack surface, turning a vendor's breach into your own data exfiltration event.