Wiz: Attackers turned Qubole’s trusted AWS access into a data-theft route

Wiz researchers say attackers used compromised credentials from Qubole’s AWS account to enter customers’ environments through trusted integration roles, including ones left active after organizations stopped using Qubole. Sentra reported dozens of victims and millions of files stolen from one customer, according to BleepingComputer. Wiz recommends reviewing CloudTrail logs, rotating exposed secrets and revoking active role sessions: changing credentials alone won’t terminate sessions already issued.