The attacker leveraged stolen IAM role credentials to establish persistent access without detection. This step involved using the compromised credentials to create a new IAM policy allowing further persistence.