Trusted by Default: Qubole Cross-Account Access Abused in the Wild

A threat actor compromised IAM credentials within Qubole's AWS account and exploited pre-existing cross-account integration roles to gain unauthorized access to multiple customer AWS environments. This is a textbook supply chain attack: customers implicitly trusted Qubole's account, and that trust was weaponized to enumerate resources, exfiltrate S3 data, and harvest further credentials. The core failure was an overly permissive, insufficiently monitored trust relationship between Qubole and its customers. It matters because a single vendor compromise cascaded into breaches across many organizations that had no direct vulnerability of their own.