Attack Chain

1. Initial Access: Attackers gain access to developer platforms through credential theft, third-party vendor dependencies, or legacy system vulnerabilities.
2. Credential Harvesting: Attackers hunt for stored environment variables, specifically those granting access to AI services like Amazon Bedrock.
3. Key Validation: Stolen keys are tested using automated, low-volume "InvokeModel" calls from residential proxy IPs.
4. Quota Enumeration: Attackers use Boto3-based scripts from hosting infrastructure to enumerate Bedrock and EC2 quotas, identifying account limits.
5. Traffic Flooding: Automated scripts initiate large-scale inference requests (reaching millions of calls) using stolen keys.
6. Evasion: Traffic is distributed across multiple cross-region inference profiles to bypass service throttling.
7. Monetization: Stolen access is integrated into public LLM resale platforms for commercial exploitation.

Impact

Observed impacts include the theft of cryptocurrency keys, unauthorized consumer billing ranging from hundreds to thousands of dollars per incident, and the exhaustion of cloud service quotas. Two specific cases analyzed by Wiz documented ~2.5 million combined inference calls, resulting in an estimated $100k+ in unauthorized service costs.

Recommendation

• Rotate all API keys and environment variables stored in developer platforms that disclosed incidents during October 2026.
• Implement strict IAM policies for AI services (e.g., AWS Bedrock) that restrict cross-region inference profiles and enforce regional limitations to reduce the blast radius of stolen keys.
• Establish monitoring for anomalous spikes in API calls, particularly for high-cost models like Claude Opus.
• Audit existing infrastructure for "shadow AI" and ensure no hardcoded credentials exist within build infrastructure or configuration files.