A cached AWS access key discovered on a single Windows workstation exposed potential pathways to 98% of entities across an enterprise's cloud infrastructure, according to research shared with The Hacker News.

The attack begins with standard AWS behavior. When a user authenticates to AWS, the system caches access credentials locally for convenience. No misconfiguration occurred. No policy violations happened. The cached key simply sat on the machine, waiting.

An attacker with basic capabilities could extract this key. From there, the path opened dramatically. The compromised credentials granted access to resources across the organization's cloud environment. Cloud infrastructure typically grants broad permissions to individual accounts or roles. One cached key becomes a skeleton key.

This scenario illustrates a fundamental identity and access management problem in cloud deployments. Organizations often assume that securing the perimeter protects their assets. They patch systems, deploy firewalls, and monitor networks. Cached credentials defeat these controls entirely.

The risk compounds across distributed teams. Remote workers, contractors, and developers all cache credentials locally. Each machine becomes a potential attack surface. Each credential sits within reach of malware, terminal access exploits, or physical theft.

AWS and other cloud providers do not enable credential encryption by default on local machines. Operating system access controls provide the only protection. An attacker who compromises the user account or gains administrator privileges retrieves credentials in seconds.

Organizations must treat cached credentials as inherent risks in modern cloud operations. They should implement credential rotation at short intervals. They should enforce hardware security modules for sensitive operations. They should adopt temporary credentials with automatic expiration instead of long-lived access keys.

The 98% figure demonstrates the danger of overly permissive identity policies. When a single credential can reach nearly all cloud resources, attack surface explodes. Least privilege principles demand granular access controls tied to specific roles and tasks.

This attack path requires no zero-day exploits, no