Loading story…
A researcher observed an attacker using a semi-autonomous coding agent to identify poorly secured OpenAI-compatible LLM resale gateways and obtain access through registration flaws, default credentials, authorization weaknesses, and account farming. The agent validated harvested inference endpoints and consolidated usable capacity behind an attacker-controlled, self-hosted New-API gateway, creating a supply chain for stolen or abused LLM access.
The captured operation loaded about 379 upstream endpoints, disabled 341 that failed validation, and presented five model aliases through a unified service with load balancing and failover. After choosing an AI honeypot as a free LLM backend, the agent exposed extensive operational data—including playbooks, reconnaissance material, API keys, target details, and working history—indicating a human-directed automated operation rather than a fully autonomous or self-replicating campaign.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
After validation, the attacker disabled 341 fake or dead channels and mapped five model aliases to surviving upstream services. A final probe found that all five aliases returned usable responses through a single attacker-controlled endpoint using load balancing and failover.
The attacker deployed a self-hosted New-API gateway and loaded roughly 379 upstream endpoints using collected credentials. When rate limits hindered automation, the agent edited the gateway’s SQLite database, cleared session rows, and injected an administrator token.
The attacker tested acquired or compromised keys and candidate endpoints, including with a factorial request and code-logic tests, to distinguish working inference services from fake or dead responses. Some targeted services exposed high default billing limits or returned complete model catalogs without authentication.
A researcher’s OpenAI-compatible AI honeypot was repeatedly selected as a free backend by the attacker’s agent and captured about 43 KB of operational material, including playbooks, reconnaissance scripts, API keys, target data, and agent working history. The captured proxy-verification instructions also exposed the operator’s direct, unproxied egress IP address.
An attacker used a semi-autonomous coding agent to identify poorly secured OpenAI-compatible LLM resale gateways and acquire access through registration flaws, default credentials, authorization weaknesses, exposed endpoints, and trial-account farming. The agent used FOFA searches and automated temporary-email and CAPTCHA-solving services to support the activity.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers running a global honeypot network reported active scanning and exploitation of Internet-facing AI inference and agent services, including **Ollama**, **LiteLLM**, **OpenClaw**, and **LangServe**. Attackers first profiled exposed endpoints to identify available models and capabilities, then exploited recently disclosed **LiteLLM** flaws to gain remote code execution and steal environment variables and access tokens. Between March and May 2026, three separate operators were observed taking over exposed Ollama and LiteLLM instances and repurposing them for offensive activity, including use of **Strix**, **HexStrike**, and an **OpenAI Codex** agent configured to suppress safety refusals. The compromised AI infrastructure was then used as backend capacity for attacks against downstream victims, while the exposed services also served as a source of stolen credentials and tokens. Researchers said they blocked attempted attacks on live targets and privately notified affected parties, warning that unauthenticated AI endpoints are now being abused both for credential theft and as operational infrastructure for malicious campaigns.
Jul 6, 2026
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026
Threat actors are actively exploiting misconfigured proxy servers to gain unauthorized access to paid Large Language Model (LLM) services, including those from OpenAI, Google Gemini, Anthropic, Meta, and others. These attacks, referred to as "LLMjacking," involve advanced enumeration techniques, server-side request forgery (SSRF), and the use of custom scripts to identify and hijack exposed LLM endpoints. The attackers leverage distributed virtual private server (VPS) infrastructure and sophisticated operational security measures, indicating a well-resourced and coordinated campaign. Stolen access to these commercial AI endpoints is being monetized on underground forums, highlighting the financial motivation and the growing underground market for compromised LLM credentials. Recent threat intelligence and incident reports confirm that this campaign has been ongoing since late 2025, with systematic, low-noise probing of enterprise AI infrastructure. Security researchers have observed attackers actively attempting to access various LLM pathways, including through honeypots set up for OpenAI, Gemini, and Claude endpoints. While there is no direct attribution to known APT groups, the technical sophistication and scale of the operation suggest involvement by organized cybercriminals or advanced grey-hat operators. Organizations are urged to review and secure their proxy configurations and monitor for unusual access patterns to prevent unauthorized use of their paid AI services.
Jun 29, 2026