FlagThis — Daily Cybersecurity Intelligence Briefing

Between October 14 and October 26, 2026, threat actors compromised Qubole's AWS management account credentials and abused pre-configured cross-account IAM trust policies to assume roles in multiple customer AWS environments via AWS STS AssumeRole. The actor harvested secrets from AWS Secrets Manager and Systems Manager Parameter Store and exfiltrated customer data. This supply-chain incident demonstrates how a single SaaS provider identity compromise can grant persistent, high-privilege access across disparate customer cloud estates through trusted IAM role relationships.