Loading story…
Attackers are increasingly monetizing stolen cloud credentials through LLMjacking: unauthorized use of hosted large-language-model services that charges inference costs to victims. In observed AWS incidents, attackers used long-lived IAM keys with AdministratorAccess to create IAM users, accept Amazon Bedrock Marketplace agreements, and invoke foundation models; earlier activity used credentials exposed through a vulnerable Laravel instance affected by CVE-2021-3129 to test access across multiple AI platforms and target Anthropic Claude through Bedrock. Adversaries have used malformed InvokeModel requests to validate access and checked whether invocation logging was enabled, while sustained abuse of Claude quotas across regions was estimated to cost more than $46,000 per day and exhaust legitimate customer capacity.
The activity has developed into a commercial access market. Researchers report that “Operation Bizarre Bazaar” scans for exposed, unauthenticated APIs and Model Context Protocol (MCP) servers using internet-search services, validates compromised access, and resells LLM compute or API access through Telegram and Discord marketplaces for cryptocurrency and PayPal. MCP compromise may also enable access to connected internal file systems or databases, extending the risk beyond fraudulent AI consumption. Organizations should eliminate long-lived privileged keys, use short-lived role credentials and least-privilege permissions, remediate exposed services and secret leaks, and investigate new Bedrock activity—especially identity creation, unfamiliar source IPs, service enumeration, access-denied events, and missing or disabled CloudTrail and model-invocation logs.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Independent research described a commercialized LLMjacking ecosystem dubbed Operation Bizarre Bazaar, which scanned for exposed endpoints including unauthenticated APIs and MCP servers. The campaign reportedly validated compromised access and resold LLM compute cycles and API access through the silver.inc marketplace on Telegram and Discord.
Sysdig Threat Research Team observed attackers exploiting a vulnerable Laravel instance affected by CVE-2021-3129 to steal cloud credentials and probe hosted LLM services. The actors tested ten AI platforms, including AWS Bedrock Claude models, used malformed InvokeModel requests to validate access, and checked invocation logging before potential abuse or resale through an LLM reverse proxy.
An attacker used a leaked long-lived IAM access key with AdministratorAccess to access an AWS account, create a new IAM user, accept AWS Marketplace agreements for foundation models, and invoke Amazon Bedrock models. The unauthorized inference generated charges against the victim account and could support direct use or resale of the hijacked AI access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
feeds.fortinet.com
Open sourceblog.gitguardian.com
Open sourcesysdig.com
Open sourcesysdig.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FortiGuard Labs documented an **LLMjacking** intrusion in which attackers used a leaked, long-lived AWS IAM access key with `AdministratorAccess` to create a new IAM user, subscribe to premium foundation models through AWS Marketplace, and run inference charges against the victim organization. The financial exposure can be substantial: abuse of Claude 2.x may exceed **$46,000 per day**, while Claude 3 Opus usage may exceed **$100,000 per day**. The actors may create Amazon Bedrock service-specific API keys to conceal the activity and resell stolen model access through low-cost chatbot subscriptions promoted on Telegram and Discord. Because requests are made with valid AWS credentials, the abuse can resemble legitimate usage; organizations should eliminate long-lived privileged access keys in favor of short-lived assumed-role credentials, enable organization-wide CloudTrail and Bedrock invocation logging, and investigate new Bedrock activity alongside identity, IP, enumeration, and access-denied anomalies.
Sep 3, 2026
Threat actors are actively exploiting misconfigured proxy servers to gain unauthorized access to paid Large Language Model (LLM) services, including those from OpenAI, Google Gemini, Anthropic, Meta, and others. These attacks, referred to as "LLMjacking," involve advanced enumeration techniques, server-side request forgery (SSRF), and the use of custom scripts to identify and hijack exposed LLM endpoints. The attackers leverage distributed virtual private server (VPS) infrastructure and sophisticated operational security measures, indicating a well-resourced and coordinated campaign. Stolen access to these commercial AI endpoints is being monetized on underground forums, highlighting the financial motivation and the growing underground market for compromised LLM credentials. Recent threat intelligence and incident reports confirm that this campaign has been ongoing since late 2025, with systematic, low-noise probing of enterprise AI infrastructure. Security researchers have observed attackers actively attempting to access various LLM pathways, including through honeypots set up for OpenAI, Gemini, and Claude endpoints. While there is no direct attribution to known APT groups, the technical sophistication and scale of the operation suggest involvement by organized cybercriminals or advanced grey-hat operators. Organizations are urged to review and secure their proxy configurations and monitor for unusual access patterns to prevent unauthorized use of their paid AI services.
Jun 29, 2026
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026