# Leaked cloud keys to admin persistence

Long-lived keys in code or CI that can create users, policies, or admin sessions

_Area: Cloud and container security. Seen in 4 disclosed reports; latest 2026-10-20. Updated 2026-11-02._

## How it works
A long-lived cloud access key (an AWS `AKIA` key, a GCP service-account credential) is stored somewhere it can be read by more people or systems than intended: a private repo, a CI secret, a config file. The key belongs to a non-human service account that was given broad rights so automation "just works". The broken assumption is that the secret stays secret and that the service account is low-value. Once the key leaks, the attacker inherits every permission the account has, including the ability to mint new identities (users, keys, policies, role assumptions) that outlive the original key. [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)

## Where it shows up
- Hardcoded `AKIA` keys, DB connection strings, or tokens committed to repos, including private ones [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)
- CI/service accounts with `AssumeRole` to admin, `iam:CreateUser`, `iam:CreatePolicy`, `iam:CreateAccessKey`, or `ssm:SendCommand` [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)
- Keys whose names encode their purpose (`ses-...`) and that carry service permissions beyond their job [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md)
- Privileged GCP credentials able to delete org policy (`iam.allowedPolicyMemberDomains`) or grant `roles/billing.admin` [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md)
- Non-human accounts authenticating from VPN/cloud IPs or with CLI user-agents where the baseline is CI tooling [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)

## How to review
The invariant: no long-lived credential readable by a repo or CI job may hold identity-creation or admin-assume rights. Check each service account's effective permissions, not its intended ones. Confirm keys are short-lived (OIDC/role assumption) or scoped so that even if leaked they cannot create users, policies, or admin sessions. For GCP, confirm org policy that restricts domain membership cannot be removed by the same identity that holds billing roles. [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)

## How finders spotted it
- Triaged simultaneous detections on a non-human CI account (odd country, VPN, offensive-tool API calls), then compared against a 30-day baseline of only Amazon IPs and CI user-agents; the anomalous `AssumeRole`/`SendCommand` stood out [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)
- Pivoted from management-plane anomalies to the data plane (S3 `PutObject` path fields) to surface staged exfiltration tooling, and correlated the attacker IP tenant-wide across AWS and GitHub audit logs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)
- Correlated anomalous logins, org-policy deletions, external-domain IAM members, and billing surges across intrusions [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md)
- Used `GetCallerIdentity` to read the key name (`ses-`), and flagged a 10-second multi-region `PutAccountDetails` burst as automation [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md)
- Hunted known LLM-abuse techniques plus honeypot IOCs; failed `InvokeModel` error messages revealed follow-on `CreateUser`/`CreatePolicy` attempts, then searched the same pattern across environments [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)

## Variants seen
- GitHub token compromise cloning private repos to harvest AWS keys, then cross-account pivot and RCE [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md)
- Phished GCP admin creds stripping org policy and linking foreign projects to victim billing [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md)
- Leaked SES key escaping sandbox via multi-region calls to send phishing [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md)
- Compromised IAM user invoking Bedrock, then creating users/policies for persistence [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md)

## Impact and severity
High to critical: cross-account lateral movement, RCE on a production domain controller, and SQL/billing data exfiltration [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md); attacker projects billed to victims via mass LLM inference [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md); high-volume phishing from a trusted sender [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md); persistence via new IAM identities, blocked only by SCPs [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md). Impact rose with over-privilege and with chaining a single leaked secret into identity creation.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Amazon Simple Email Service** (version not stated): From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover. Report: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-from-phishing-to-llmjacking.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-discovers-cloud-email-abuse-campaign.md
- E4: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-2401-llm-hijacking-aws.md