Loading story…
Sysdig researchers observed a threat actor abusing a publicly exposed, unauthenticated Ollama server as the reasoning backend for an automated offensive framework dubbed VAPT. The tool chained AI-driven stages to fingerprint services, map vulnerabilities, generate proof-of-concept exploits, craft blind SQL injection payloads, extract credentials, plan file reads, and choose privilege-escalation paths until remote command execution was achieved. Researchers said the activity marks an evolution of LLMjacking, shifting from theft of paid inference APIs to theft of self-hosted model capacity for autonomous offensive operations.
The observed sessions originated from residential IP addresses in India and targeted only private lab-style ranges and fictitious applications, indicating the actor was likely developing and tuning the framework rather than attacking public victims during the observation window. Sysdig said many Ollama deployments remain exposed because the service listens on port 11434 without authentication by default, with roughly 175,000 instances reportedly reachable across more than 130 countries. The company urged defenders to block internet exposure, add authentication through proxies or network controls, and monitor model endpoints for offensive-tooling markers such as the strings VAPTb3gin, VAPTfin, and the command:
echo VAPTb3gin; id; echo VAPTfin
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Sysdig published research describing the June 12 activity as an evolution of LLMjacking from theft of paid AI inference capacity to abuse of self-hosted model capacity for autonomous offensive operations. The report also highlighted detection anchors including the strings VAPTb3gin, VAPTfin, and __VAPTCMD__, and warned about widespread exposure of Ollama on port 11434 without authentication.
On June 12, 2026, Sysdig Threat Research Team observed a threat actor using a publicly exposed, unauthenticated Ollama server as the reasoning backend for an automated offensive framework it calls VAPT. The framework used the model to fingerprint services, identify vulnerabilities, generate exploits, craft blind SQL injection payloads, extract credentials, plan privilege escalation, and orchestrate exploitation through confirmed command execution.
Zenity described three incidents observed between March and May 2026 in which exposed Ollama and LiteLLM inference endpoints were hijacked to provide backend compute for offensive AI tooling, including Strix, HexStrike, and a Codex-based persona. The report said the operators abused unauthenticated or weakly protected endpoints without exploiting software vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcewebflow.sysdig.com
Open sourcelabs.zenity.io
Open sourceblogs.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers running a global honeypot network reported active scanning and exploitation of Internet-facing AI inference and agent services, including **Ollama**, **LiteLLM**, **OpenClaw**, and **LangServe**. Attackers first profiled exposed endpoints to identify available models and capabilities, then exploited recently disclosed **LiteLLM** flaws to gain remote code execution and steal environment variables and access tokens. Between March and May 2026, three separate operators were observed taking over exposed Ollama and LiteLLM instances and repurposing them for offensive activity, including use of **Strix**, **HexStrike**, and an **OpenAI Codex** agent configured to suppress safety refusals. The compromised AI infrastructure was then used as backend capacity for attacks against downstream victims, while the exposed services also served as a source of stolen credentials and tokens. Researchers said they blocked attempted attacks on live targets and privately notified affected parties, warning that unauthenticated AI endpoints are now being abused both for credential theft and as operational infrastructure for malicious campaigns.
Jul 6, 2026Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026