Threat actors were manipulating the Instance Metadata Service (IMDS), a core component designed to securely furnish compute instances with temporary credentials to infiltrate and navigate cloud infrastructures.

By compelling unsuspecting applications to query IMDS endpoints, attackers harvest short-lived tokens, enabling credential theft, lateral movement, and privilege escalation within victim environments.

Exploit IMDS Service

Wiz reports that the Instance Metadata Service operates at the heart of AWS, Azure, and GCP virtual machines, exposing critical data and IAM credentials via HTTP requests to the privileged 169.254.169[.]254 address.

While IMDSv2 strengthens security through session-oriented token retrieval, IMDSv1 remains vulnerable to Server-Side Request Forgery (SSRF).

Attackers exploit SSRF flaws or misconfigured workloads to proxy IMDS calls, stealing role-based credentials without direct host control.

By establishing a baseline of legitimate clients, such as AWS SDKs, EC2 agents, and nm-cloud-setup, researchers isolate processes that infrequently access IMDS.

Filtering for sensitive metadata paths (for example, /latest/meta-data/iam/security-credentials/ and /computeMetadata/v1/instance/service-accounts/) and prioritizing instances with internet exposure reveals stealthy reconnaissance and exfiltration attempts.

Two real-world findings underscore the ability of this tactic. In the first, a zero-day SSRF in pandoc (CVE-2025-51591) enabled malicious HTML