Llmjacking - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/llmjacking/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 19:37:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Unauthorized Amazon Bedrock Foundation Model Access Attemptshttps://feed.craftedsignal.io/briefs/2026-09-aws-bedrock-unauthorized-access/Fri, 18 Sep 2026 19:37:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-aws-bedrock-unauthorized-access/Detection of failed API calls attempting to enable Amazon Bedrock foundation model access, serving as a high-signal indicator for credential boundary-testing and potential LLMjacking.This threat brief focuses on detecting unauthorized attempts to enable account-level access to Amazon Bedrock foundation models. Attackers who compromise AWS identities may attempt to enable model entitlements or agree to model EULAs to unlock expensive foundation models for malicious usage, a technique often referred to as LLMjacking. By monitoring for denied control-plane API calls, defenders can identify compromised or under-privileged principals performing boundary-testing. This activity is critical to intercept, as successfully enabling these entitlements provides the necessary persistence for subsequent model invocation and abuse. While access-denied errors can stem from benign permission gaps in CI/CD pipelines or new employee onboarding, recurring unauthorized requests from unexpected source IPs or user agents are strong indicators of potential malicious reconnaissance.

Impact

Successful exploitation of these Bedrock control-plane functions allows attackers to gain unauthorized access to LLM services, resulting in unauthorized costs, data exfiltration through model interaction, and potential abuse of generative AI capabilities. Organizations that do not monitor for these denied attempts risk missing the initial reconnaissance phase of an LLMjacking attack.

Recommendation

Prioritize the investigation of unauthorized Bedrock control-plane activity to identify compromised credentials before they are successfully used to unlock models.

  • Deploy the detection rule provided below to your SIEM to monitor for 'AccessDenied' events on Bedrock configuration APIs.
  • Establish a baseline for users and roles authorized to perform 'PutFoundationModelEntitlement', 'PutUseCaseForModelAccess', and 'CreateFoundationModelAgreement' actions.
  • Use CloudTrail logs to correlate denied Bedrock attempts with other suspicious IAM activity, such as permission enumeration or credential creation.
  • Implement IAM Service Control Policies (SCPs) to restrict Bedrock management capabilities to specific, hardened administrator roles.
]]>lowadvisorycloudawsbedrockllmjackingpersistenceLLMjacking via Compromised AWS Long-Term IAM Credentialshttps://feed.craftedsignal.io/briefs/2026-09-llmjacking-bedrock/Fri, 18 Sep 2026 19:29:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-llmjacking-bedrock/Adversaries are abusing stolen long-term AWS IAM access keys to perform unauthorized reconnaissance and high-cost model inference within Amazon Bedrock.LLMjacking involves threat actors gaining access to cloud environments and utilizing stolen long-term IAM credentials (AKIA* access keys) to abuse AI services. In the context of Amazon Bedrock, attackers prioritize identifying available foundation models for potential exploitation to run high-volume or high-cost model inference. This activity is notable because legitimate production workloads utilizing Bedrock typically operate under temporary IAM roles, making the use of long-term user keys for discovery and invocation highly irregular. Defenders should monitor for patterns where the same access key performs enumeration followed immediately by model invocation. This activity indicates a potential compromise of IAM credentials and an attempt to leverage the organization's cloud resources for unauthorized AI model consumption at the account owner's expense.

Impact

LLMjacking can result in significant financial impact due to high-volume model inference costs. Furthermore, it indicates that a threat actor has successfully gained Initial Access via compromised credentials, potentially allowing for broader exploitation of other AWS services such as S3 or Secrets Manager if the IAM user has excessive permissions.

Recommendation

  • Monitor AWS CloudTrail logs for the sequence of ListFoundationModels followed by InvokeModel, InvokeModelWithResponseStream, Converse, or ConverseStream by the same access key within 15 minutes.
  • Prioritize auditing of all existing long-term IAM user access keys, enforcing rotation, and migrating Bedrock workloads to IAM roles with short-lived credentials.
  • Investigate the source IP and user agent associated with any long-term key performing Bedrock operations to identify potential unauthorized access or credential exposure.
  • Restrict the usage of long-term keys for AI services through Service Control Policies (SCPs) where business requirements permit.
]]>highadvisorycloudllmawsllmjackingidentity-audit