Threat Actors Exploit EKS for Compute Hijacking and Workload Modification

In June 2026, threat actors targeted Amazon EKS clusters by exploiting Kubernetes credentials or IAM roles to modify workloads and hijack compute resources. Attackers gained initial access through application-layer vulnerabilities, allowing them to deploy cryptomining containers and alter existing workloads. They leveraged misconfigured Kubernetes API servers and overly permissive service account tokens to escalate privileges and establish persistence. The modifications included injecting malicious code into running containers and altering cluster configurations, which could affect multiple tenants in shared environments. AWS recommends implementing strict access controls and monitoring for anomalous activities to mitigate these risks. The situation highlights the ongoing threat to cloud environments and the need for robust security measures.

Key Points: • Threat actors exploit EKS clusters by modifying workloads and deploying cryptomining containers. • Initial access is gained through application-layer vulnerabilities and misconfigured Kubernetes settings. • AWS recommends strict access controls and monitoring to mitigate risks associated with EKS exploitation.