Stolen IAM credentials at Qubole opened the AWS environments of customers who forgot to revoke their trust
On November 9, 2026, Wiz documented a campaign that abused cross-account IAM roles granted to Qubole to siphon secrets and S3 buckets from multiple AWS environments. For any cloud team, it is proof that an unrevoked trust relationship is the same thing as a door left open.