Loading story…
FortiGuard Labs documented an LLMjacking intrusion in which attackers used a leaked, long-lived AWS IAM access key with AdministratorAccess to create a new IAM user, subscribe to premium foundation models through AWS Marketplace, and run inference charges against the victim organization. The financial exposure can be substantial: abuse of Claude 2.x may exceed $46,000 per day, while Claude 3 Opus usage may exceed $100,000 per day.
The actors may create Amazon Bedrock service-specific API keys to conceal the activity and resell stolen model access through low-cost chatbot subscriptions promoted on Telegram and Discord. Because requests are made with valid AWS credentials, the abuse can resemble legitimate usage; organizations should eliminate long-lived privileged access keys in favor of short-lived assumed-role credentials, enable organization-wide CloudTrail and Bedrock invocation logging, and investigate new Bedrock activity alongside identity, IP, enumeration, and access-denied anomalies.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs documented attackers using a leaked long-lived AWS IAM key with AdministratorAccess to create an IAM user, subscribe to foundation models through AWS Marketplace, and run inference billed to the victim organization. The report said stolen model access can be resold through low-cost chatbot subscriptions and linked Operation Bizarre Bazaar to more than 35,000 attack sessions across over 30 LLM providers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly monetizing stolen cloud credentials through **LLMjacking**: unauthorized use of hosted large-language-model services that charges inference costs to victims. In observed AWS incidents, attackers used long-lived IAM keys with `AdministratorAccess` to create IAM users, accept Amazon Bedrock Marketplace agreements, and invoke foundation models; earlier activity used credentials exposed through a vulnerable Laravel instance affected by `CVE-2021-3129` to test access across multiple AI platforms and target Anthropic Claude through Bedrock. Adversaries have used malformed `InvokeModel` requests to validate access and checked whether invocation logging was enabled, while sustained abuse of Claude quotas across regions was estimated to cost more than $46,000 per day and exhaust legitimate customer capacity. The activity has developed into a commercial access market. Researchers report that “Operation Bizarre Bazaar” scans for exposed, unauthenticated APIs and Model Context Protocol (MCP) servers using internet-search services, validates compromised access, and resells LLM compute or API access through Telegram and Discord marketplaces for cryptocurrency and PayPal. MCP compromise may also enable access to connected internal file systems or databases, extending the risk beyond fraudulent AI consumption. Organizations should eliminate long-lived privileged keys, use short-lived role credentials and least-privilege permissions, remediate exposed services and secret leaks, and investigate new Bedrock activity—especially identity creation, unfamiliar source IPs, service enumeration, access-denied events, and missing or disabled CloudTrail and model-invocation logs.
Sep 13, 2026
Darktrace reported that attackers compromised a publicly exposed AWS EC2 instance running **LiteLLM** as an AI gateway to **Amazon Bedrock** and used it to deploy the **XMRig** cryptominer. Investigators observed internet-exposed SSH on port 22, repeated short inbound connection attempts, an HTTP download from `185.62.1.8` consistent with malware delivery, and outbound HTTPS traffic to the Monero mining pool `pool.hasvault.pro`. The host, identified as `LiteLLM-Proxy`, was later shut down, and Darktrace assessed brute-force or other SSH-based access as a plausible initial intrusion path. The incident drew attention because the compromised system was not just a compute node but an AI gateway with an instance profile tied to Bedrock resources, potentially exposing API access, IAM permissions, prompts, logs, model outputs, and downstream application workflows. Darktrace warned that such gateways can concentrate access to foundation models, proprietary data, and broader cloud resources, making them attractive targets for credential theft, abuse of AI inference services, persistence in AWS, and lateral movement. The firm recommended limiting IAM privileges, removing internet exposure from management interfaces, using short-lived credentials, segmenting AI infrastructure, and monitoring AI-specific administrative activity.
Jul 12, 2026
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as **AI token jacking**. The activity has generated nearly **$1 million in fraudulent charges** before some victims detected the abuse, with malicious infrastructure in some cases driving **tens of millions of API calls per day**. Stolen credentials are being monetized directly and also funneled through gray-market **"transfer stations"** that resell access to legitimate AI services using compromised or discounted accounts. The stolen keys are being obtained through **phishing**, **infostealer malware**, exposed file shares, public code repositories, and poisoned software packages, including self-propagating `npm` packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Aug 19, 2026