LLMjacking via Compromised AWS Long-Term IAM Credentials

LLMjacking involves threat actors gaining access to cloud environments and utilizing stolen long-term IAM credentials (AKIA* access keys) to abuse AI services. In the context of Amazon Bedrock, attackers prioritize identifying available foundation models for potential exploitation to run high-volume or high-cost model inference. This activity is notable because legitimate production workloads utilizing Bedrock typically operate under temporary IAM roles, making the use of long-term user keys for discovery and invocation highly irregular. Defenders should monitor for patterns where the same access key performs enumeration followed immediately by model invocation. This activity indicates a potential compromise of IAM credentials and an attempt to leverage the organization's cloud resources for unauthorized AI model consumption at the account owner's expense.

Impact

LLMjacking can result in significant financial impact due to high-volume model inference costs. Furthermore, it indicates that a threat actor has successfully gained Initial Access via compromised credentials, potentially allowing for broader exploitation of other AWS services such as S3 or Secrets Manager if the IAM user has excessive permissions.

Recommendation

• Monitor AWS CloudTrail logs for the sequence of ListFoundationModels followed by InvokeModel, InvokeModelWithResponseStream, Converse, or ConverseStream by the same access key within 15 minutes.
• Prioritize auditing of all existing long-term IAM user access keys, enforcing rotation, and migrating Bedrock workloads to IAM roles with short-lived credentials.
• Investigate the source IP and user agent associated with any long-term key performing Bedrock operations to identify potential unauthorized access or credential exposure.
• Restrict the usage of long-term keys for AI services through Service Control Policies (SCPs) where business requirements permit.