LLMJacking: Cybercriminal Resale of Stolen Cloud LLM Access

Threat actors are increasingly monetizing compromised cloud infrastructure through a practice termed LLMJacking. Attackers gain initial access to organizations, specifically targeting LLM endpoints and associated API keys. Once access is established, the stolen resources are aggregated and resold through underground "LLM Mixer" services. This model allows attackers to profit by routing customer requests through the victim’s environment, often resulting in significant, rapid financial losses for the victim due to cloud resource consumption billing.

Attack Chain

1. Initial Access: Attackers obtain cloud identity tokens, service account keys, or GitHub Personal Access Tokens (PATs) via phishing, session hijacking, or exploitation of web vulnerabilities in containerized environments.
2. Credential Validation: Attackers perform minimal API requests, often sending a single output token, to verify the validity of stolen credentials while remaining under detection thresholds.
3. Persistence Establishment: Attackers use compromised federation tokens to programmatically generate new, long-lived access keys, bypassing existing MFA controls.
4. Infrastructure Integration: Compromised credentials are integrated into underground "LLM Mixer" services, which act as middlemen to resell enterprise LLM capacity.
5. Resource Abuse: The mixer service routes external customer requests through the victim’s cloud environment, causing rapid spikes in computing resource consumption.
6. Monetization: The threat actor collects subscription fees from the reseller network while the victim organization absorbs the high costs of the unauthorized LLM inference requests.

Impact

Observed impacts include rapid spikes in cloud resource consumption. Incidents have resulted in fraudulent charges exceeding $100,000 USD in a single day, with cumulative costs for some organizations reaching $1 million USD before access was revoked.

Recommendation

• Implement centralized secrets management to rotate and restrict service account keys and API credentials.
• Enforce the principle of least privilege for all cloud service accounts and API access tokens.
• Deploy automated secret scanning tools across internal code repositories (e.g., GitHub, GitLab) to prevent accidental exposure of tokens.
• Establish automated billing and resource consumption alerts to identify unauthorized usage spikes in real-time.
• Implement rate limiting and network allow-listing for all public-facing LLM endpoints.