Loading story…
Researchers and threat analysts have warned that unauthorized LLM shadow APIs and proxy services are misrepresenting access to frontier models such as GPT, Gemini, and Claude while exposing users to fraud and data leakage. A March 2026 academic audit identified 17 shadow APIs cited across 187 papers and found major discrepancies between official APIs and the services claiming to mirror them, including performance divergence of up to 47.21%, inconsistent safety behavior, and identity verification failures in 45.83% of fingerprint tests. The findings indicate that some providers silently substitute models or otherwise fail to deliver the systems they advertise, undermining research reproducibility and trust in downstream results.
Separate reporting describes a growing "dark token economy" in which unofficial proxy operators resell discounted access using pooled, fraudulent, or improperly sourced accounts, particularly in markets affected by regional restrictions. These services allegedly profit through price arbitrage, silent model swapping, and extensive logging of prompts and responses, creating risks that sensitive enterprise or research data could be harvested for fraud or unauthorized model distillation. Analysts also noted that open-source gateway tools and public repositories have lowered the barrier to operating such proxies, making prompt exposure and degraded model reliability a broader supply-chain risk rather than an isolated breach.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
SOCRadar published an analysis describing a 'dark token economy' in which unauthorized proxy services resell access to frontier LLM APIs using fraudulent or pooled accounts. The report says these proxies may log prompts and responses, substitute models, and enable fraud or distillation, creating global data leakage and reliability risks.
A March 2026 research paper reports what it describes as the first systematic audit comparing official LLM APIs with corresponding shadow APIs. The study identified 17 shadow APIs that had been used in 187 academic papers and found deceptive practices including major performance divergence, inconsistent safety behavior, and identity verification failures.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting misconfigured proxy servers to gain unauthorized access to paid Large Language Model (LLM) services, including those from OpenAI, Google Gemini, Anthropic, Meta, and others. These attacks, referred to as "LLMjacking," involve advanced enumeration techniques, server-side request forgery (SSRF), and the use of custom scripts to identify and hijack exposed LLM endpoints. The attackers leverage distributed virtual private server (VPS) infrastructure and sophisticated operational security measures, indicating a well-resourced and coordinated campaign. Stolen access to these commercial AI endpoints is being monetized on underground forums, highlighting the financial motivation and the growing underground market for compromised LLM credentials. Recent threat intelligence and incident reports confirm that this campaign has been ongoing since late 2025, with systematic, low-noise probing of enterprise AI infrastructure. Security researchers have observed attackers actively attempting to access various LLM pathways, including through honeypots set up for OpenAI, Gemini, and Claude endpoints. While there is no direct attribution to known APT groups, the technical sophistication and scale of the operation suggest involvement by organized cybercriminals or advanced grey-hat operators. Organizations are urged to review and secure their proxy configurations and monitor for unusual access patterns to prevent unauthorized use of their paid AI services.
Jun 29, 2026
Attackers are increasingly monetizing stolen cloud credentials through **LLMjacking**: unauthorized use of hosted large-language-model services that charges inference costs to victims. In observed AWS incidents, attackers used long-lived IAM keys with `AdministratorAccess` to create IAM users, accept Amazon Bedrock Marketplace agreements, and invoke foundation models; earlier activity used credentials exposed through a vulnerable Laravel instance affected by `CVE-2021-3129` to test access across multiple AI platforms and target Anthropic Claude through Bedrock. Adversaries have used malformed `InvokeModel` requests to validate access and checked whether invocation logging was enabled, while sustained abuse of Claude quotas across regions was estimated to cost more than $46,000 per day and exhaust legitimate customer capacity. The activity has developed into a commercial access market. Researchers report that “Operation Bizarre Bazaar” scans for exposed, unauthenticated APIs and Model Context Protocol (MCP) servers using internet-search services, validates compromised access, and resells LLM compute or API access through Telegram and Discord marketplaces for cryptocurrency and PayPal. MCP compromise may also enable access to connected internal file systems or databases, extending the risk beyond fraudulent AI consumption. Organizations should eliminate long-lived privileged keys, use short-lived role credentials and least-privilege permissions, remediate exposed services and secret leaks, and investigate new Bedrock activity—especially identity creation, unfamiliar source IPs, service enumeration, access-denied events, and missing or disabled CloudTrail and model-invocation logs.
Sep 13, 2026
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026