New 'Bucket Hijacking' Attack Can Silently Reroute Your Cloud Data to Hackers

Unit 42 reveals a critical cloud attack, bucket hijacking, affecting Google, AWS, Azure. Learn prevention tips and protect your data.

By Content Team

Jun 27, 2026

ON THIS PAGE

Researchers at Unit 42 have uncovered a serious cloud attack technique called bucket hijacking, confirmed to work across Google Cloud, AWS and Microsoft Azure, all three of which were notified through responsible disclosure. The method exploits a simple but fundamental flaw: cloud storage bucket names are globally unique, meaning whoever owns the name owns the destination.

An attacker holding bucket deletion permissions inside the target environment can delete an active storage bucket, immediately re-register the same name — on Azure they'd need to be in the same tenant — and watch the original data stream of audit logs, telemetry and metrics flow silently into their environment. No alerts fire. No errors appear. The pipeline just keeps running.

Unit 42 has seen no sign of this being used in the wild, and notes that's cold comfort: once deployed, it would be extremely hard to detect. The biggest exposure is the broad storage-admin roles enterprises hand out routinely.

Unit 42 recommends restricting deletion permissions, enforcing data perimeter controls like AWS SCPs and Google Cloud VPC Service Controls, monitoring bucket deletion API calls closely, and enabling AWS account-regional S3 namespaces where available.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?