{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/northflank.com/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["northflank.com"],"_cs_severities":["high"],"_cs_tags":["cloud-security","credential-theft","llmjacking","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Northflank"],"content_html":"\u003cp\u003eNorthflank, a cloud application hosting provider, experienced a security breach in which unauthorized actors accessed customer account data. The attackers specifically targeted and exfiltrated environment variables, which included API keys for various AI services. These keys were subsequently used by threat actors to perform unauthorized computing tasks using customers' cloud-based AI resources, a technique referred to by researchers as 'LLMjacking'.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe breach resulted in the compromise of sensitive customer environment variables and the theft of AI API keys. This enables unauthorized third parties to charge computing costs to the victims' accounts and potential access to underlying AI service platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRotate all API keys and secrets stored within Northflank environment variables immediately.\u003c/li\u003e\n\u003cli\u003eReview AI provider billing logs and usage dashboards for spikes in activity or anomalous requests originating from IP addresses or locations not associated with your infrastructure.\u003c/li\u003e\n\u003cli\u003eImplement tight access controls on API keys, utilizing scoping and restrictive usage limits where supported by the AI service provider.\u003c/li\u003e\n\u003cli\u003eAudit current environment variable configurations to ensure no unnecessary sensitive credentials are stored in plain text or accessible via platform management interfaces.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T09:17:19Z","date_published":"2026-11-04T09:17:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-northflank-breach/","summary":"Northflank suffered a security breach resulting in the exfiltration of customer environment variables, facilitating 'LLMjacking' through the unauthorized use of stolen AI API keys.","title":"Northflank environment variable compromise and AI API key abuse","url":"https://feed.craftedsignal.io/briefs/2026-11-northflank-breach/"}],"language":"en","title":"CraftedSignal Threat Feed - Northflank.com","version":"https://jsonfeed.org/version/1.1"}