Llmjacking

A coordinated wave of attacks against at least nine AI developer platforms has enabled mass LLMJacking, where stolen API keys are abused for large-scale inference traffic and resold via illicit markets.

High-privilege Azure principals accessing Microsoft Foundry API keys or connection secrets are being monitored to prevent LLMjacking and unauthorized data pivoting.

LLMjacking operators utilize compromised AWS credentials to perform unauthorized model inference, characterized by a single identity invoking Amazon Bedrock from geographically dispersed source IPs.

Threat actors are hijacking Google Cloud Platform billing accounts via phishing and policy manipulation to conduct large-scale, unauthorized LLM inference, resulting in significant financial losses for victims.

Adversaries are utilizing stolen GCP user or service account credentials to perform unauthorized AI tasks across geographically distant locations, indicating LLMjacking and credential abuse.

High volumes of GenerateContent requests from a single IP against Vertex AI models indicate potential model extraction, automated scraping, or LLMjacking attacks.

Threat actors are leveraging stolen Amazon Bedrock API keys, intended for model invocation, to perform unauthorized destructive control-plane actions such as disabling guardrails and logging to facilitate LLMjacking or sabotage.

Detection of failed API calls attempting to enable Amazon Bedrock foundation model access, serving as a high-signal indicator for credential boundary-testing and potential LLMjacking.

Adversaries are abusing stolen long-term AWS IAM access keys to perform unauthorized reconnaissance and high-cost model inference within Amazon Bedrock.