Hackers Abuse IMDS Service for Cloud Initial Access

Hackers are increasingly abusing the Instance Metadata Service (IMDS) to gain initial access to cloud environments, a practice highlighted in a piece published on 23 September 2025. The article notes that IMDS provides temporary credentials and configuration data to virtual machines, and that attackers exploit flaws such as SSRF and misconfigurations to proxy requests to IMDS from within the instance.

It cites two real-world cases uncovered by the Wiz Research team: a zero-day SSRF vulnerability in the Pandoc document converter (CVE-2025-51591) that attempted to target IMDS, and a misconfigured ClickHouse database in GCP abused via its URL query feature to attempt metadata theft, with missing permissions halting the attempt. The Wiz team emphasises enforcing IMDSv2 and monitoring for anomalous metadata requests as key defensive measures.

According to Wiz, data-driven threat hunting can detect unusual IMDS activity and even uncover zero-day exploits in popular services. The piece concludes that combining telemetry, machine learning, and threat intelligence can help security teams safeguard cloud environments before credentials fall into the wrong hands.