--- title: Qubole supply chain attack exposed AWS, Entra ID, and... description: Attackers abused AWS cross-account IAM roles tied to Qubole to breach dozens of customer environments between October 14 and 26. Wiz, Sentra and Mandiant found... canonical: https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials | daily.dev og:description: Attackers abused AWS cross-account IAM roles tied to Qubole to breach dozens of customer environments between October 14 and 26. Wiz, Sentra and Mandiant found... og:url: https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix og:image: https://api.daily.dev/og/posts/QnnrnRzix.png og:image:alt: Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers abused AWS cross-account IAM roles tied to Qubole to breach dozens of customer environments between October 14 and 26. Wiz, Sentra and Mandiant found the attacker used Qubole IAM credentials to assume trusted customer roles, even in accounts that had stopped using Qubole. They enumerated S3 buckets, EC2, Secrets Manager and Parameter Store, downloading entire buckets and testing credentials with TruffleHog. Sentra found over 100 passwords and keys read within minutes, including AWS, Microsoft Entra ID, and Okta OAuth credentials. Wiz also found a bootable Linux ISO, 'sso_agent.iso', on the attacker's OVH server, with no deployments found. No group has been attributed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers abuse Qubole's AWS cross-account IAM roles to breach customer environments? Attackers used stolen IAM credentials belonging to Qubole's AWS account (805246085872) to assume cross-account roles that customers had granted Qubole, satisfying the required External ID check. The campaign ran October 14 to 26, used Mullvad VPN and an OVH-hosted VPS, and affected dozens of customers, including some who had already stopped using Qubole but left the trust relationship active. _daily.dev helps teams tracking supply chain incidents like this stay current on third-party IAM risks._ ### What credentials and data did the Qubole supply chain attackers steal? Attackers retrieved AWS access keys, Microsoft Entra ID service principal credentials, and Okta OAuth client credentials from Secrets Manager, Parameter Store, and Lambda configurations, then tested them with the secrets-scanning tool TruffleHog. Sentra identified more than 100 passwords and keys read within minutes, plus thousands more credential records in downloaded S3 files, with entire buckets exfiltrated in some sessions. _security teams auditing credential exposure after incidents like this can track similar breach reports on daily.dev._ ### How can organizations protect themselves from third-party cross-account IAM supply chain attacks like the Qubole breach? Wiz recommends reviewing AWS CloudTrail logs back to October 1, 2026 for suspicious AssumeRole activity from non-AWS infrastructure, removing unused third-party integrations, narrowing trust policies to specific vendor IAM principals instead of entire AWS accounts, and restricting role assumption to documented vendor IP ranges or VPC endpoint conditions. _cloud engineers hardening IAM trust policies can follow ongoing incident lessons like this one on daily.dev._ ## Similar posts on daily.dev - [How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment](https://daily.dev/posts/how-a-single-overprivileged-service-turned-the-lexisnexis-breach-into-a-keys-to-the-kingdom-moment-lazovvtmj) · Security Boulevard · 0 upvotes · 0 comments - [From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach](https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid) · FortiGuard Threat Research · 1 upvotes · 0 comments - [When a vendor's breach becomes yours: lessons from the Klue incident](https://daily.dev/posts/when-a-vendor-s-breach-becomes-yours-lessons-from-the-klue-incident-eq7gyx5af) · Snyk · 0 upvotes · 0 comments - [Crypto crooks co-opt stolen AWS creds to mine coins](https://daily.dev/posts/crypto-crooks-co-opt-stolen-aws-creds-to-mine-coins-1jnwvi7wk) · The Register · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#iam](https://daily.dev/tags/iam), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials","url":"https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix"},"datePublished":"2026-11-10T12:16:25.778Z","dateModified":"2026-11-10T19:42:08.059Z","description":"Attackers abused AWS cross-account IAM roles tied to Qubole to breach dozens of customer environments between October 14 and 26. Wiz, Sentra and Mandiant found...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d94cdde5b5726c80b47ce29e6793e4ad?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d94cdde5b5726c80b47ce29e6793e4ad?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,aws,iam,okta","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/qubole-supply-chain-attack-exposed-aws-entra-id-and-okta-credentials-qnnrnrzix#faq","mainEntity":[{"@type":"Question","name":"How did attackers abuse Qubole's AWS cross-account IAM roles to breach customer environments?","acceptedAnswer":{"@type":"Answer","text":"Attackers used stolen IAM credentials belonging to Qubole's AWS account (805246085872) to assume cross-account roles that customers had granted Qubole, satisfying the required External ID check. The campaign ran October 14 to 26, used Mullvad VPN and an OVH-hosted VPS, and affected dozens of customers, including some who had already stopped using Qubole but left the trust relationship active. daily.dev helps teams tracking supply chain incidents like this stay current on third-party IAM risks."}},{"@type":"Question","name":"What credentials and data did the Qubole supply chain attackers steal?","acceptedAnswer":{"@type":"Answer","text":"Attackers retrieved AWS access keys, Microsoft Entra ID service principal credentials, and Okta OAuth client credentials from Secrets Manager, Parameter Store, and Lambda configurations, then tested them with the secrets-scanning tool TruffleHog. Sentra identified more than 100 passwords and keys read within minutes, plus thousands more credential records in downloaded S3 files, with entire buckets exfiltrated in some sessions. security teams auditing credential exposure after incidents like this can track similar breach reports on daily.dev."}},{"@type":"Question","name":"How can organizations protect themselves from third-party cross-account IAM supply chain attacks like the Qubole breach?","acceptedAnswer":{"@type":"Answer","text":"Wiz recommends reviewing AWS CloudTrail logs back to October 1, 2026 for suspicious AssumeRole activity from non-AWS infrastructure, removing unused third-party integrations, narrowing trust policies to specific vendor IAM principals instead of entire AWS accounts, and restricting role assumption to documented vendor IP ranges or VPC endpoint conditions. cloud engineers hardening IAM trust policies can follow ongoing incident lessons like this one on daily.dev."}}]} ```