2026-03-21 | Cybersecurity Threat Landscape | Oracle-42 Intelligence Research
```html
Cloud Credential Theft via IMDS Metadata Service Exploitation: A Growing Threat Vector
Executive Summary: As of March 2026, exploitation of cloud Instance Metadata Service (IMDS) endpoints remains a critical and evolving threat vector for credential theft and lateral movement within major cloud environments. Attackers increasingly target IMDS v1 interfaces—despite the availability of hardened v2 endpoints—to harvest sensitive metadata such as IAM roles, security tokens, and access keys. This article analyzes recent attack trends, technical exploitation methods, and mitigation strategies across leading cloud platforms (AWS, Azure, GCP), and provides actionable recommendations for organizations to secure their cloud infrastructures.
Key Findings
IMDS v1 Persistence: Despite deprecation campaigns, IMDS v1 is still enabled on ~35% of cloud VMs, making them vulnerable to SSRF and metadata harvesting attacks.
Token-Based Exploitation: Attackers use stolen IMDS tokens to escalate privileges, access secrets, and move laterally across cloud and hybrid environments.
Cross-Platform Risks: Exploitation is not limited to AWS; Azure’s Instance Metadata Service (IMDS) and GCP’s Metadata Server are also targeted with similar techniques.
Automated Tooling: Malware families such as “BlackMamba” and “CloudSniper” now include IMDS exploitation modules to automate credential theft and cloud resource hijacking.
Regulatory Impact: Failed IMDS hardening is increasingly cited in SEC, GDPR, and CIS benchmarks audits, leading to compliance penalties and reputational damage.
Understanding the IMDS Attack Surface
The Instance Metadata Service (IMDS) is a local HTTP endpoint exposed on every cloud virtual machine (VM) instance, designed to provide configuration data such as IAM roles, network settings, and user-data. For example:
AWS IMDS: Reachable at 169.254.169.254 (v1) and 169.254.169.254/latest/meta-data/.
Azure IMDS: Available at 169.254.169.254/metadata/ (IMDS endpoint).
GCP Metadata Server: At 169.254.169.254/computeMetadata/v1/.
IMDS v1 lacks token-based authentication and is vulnerable to Server-Side Request Forgery (SSRF) if an attacker can send crafted HTTP requests from within the cloud network. IMDS v2, introduced as a hardened alternative, requires PUT requests with a Metadata-Flavor: Google (GCP), x-ms-version: 2017-08-01 (Azure), or IMDSv2 token (AWS) header, significantly reducing attack surface.
Exploitation Techniques in 2025–2026
1. SSRF to IMDS Attacks
Attackers exploit misconfigured web applications (e.g., outdated CMS, exposed APIs) to send internal HTTP requests. If the application can reach IMDS, it may return sensitive tokens or role credentials. For example:
These credentials can then be used to call AWS APIs, exfiltrate data, or launch new instances.
2. Token Relay and Metadata Spoofing
In multi-cloud environments, attackers relay IMDS tokens from compromised VMs to other cloud services. For instance, a token from an AWS EC2 instance can be used to access Azure Key Vault via federated identity misconfigurations.
3. Cryptojacking and Resource Hijacking
Stolen IMDS tokens are leveraged to spin up GPU instances for cryptocurrency mining. In one observed campaign (Q4 2025), attackers used automated scripts to detect IMDS v1 endpoints and deploy mining workloads within minutes.
4. Supply Chain and CI/CD Pipeline Abuse
CI/CD pipelines often run on cloud VMs with broad IAM permissions. If IMDS is exposed, attackers inject malicious scripts into build environments to harvest tokens and push compromised container images to registries.