LLMJacking Campaigns Expand, Reselling Stolen Cloud LLM Access Costs Victims Up to $1M
Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗
Cybercriminals have industrialized LLMjacking, the practice of stealing cloud credentials to gain unauthorized access to hosted large language models (LLMs) and reselling that access to other threat actors. According to the report, attackers harvest exposed or leaked cloud API keys and credentials for services such as AWS, Azure, and Google Cloud to access LLM endpoints like Amazon Bedrock and other generative AI services, then resell proxied access through underground channels. Some victim organizations reportedly faced bills as high as $1 million in resource consumption before their cloud providers detected the abuse and revoked access. The activity represents a growing monetization vector distinct from traditional data theft, turning compromised cloud accounts into a recurring revenue stream for criminal resellers.
Detalhes técnicos
Attackers typically obtain valid cloud credentials through leaked secrets, misconfigurations, or credential-stuffing, then use them to invoke LLM APIs at scale, generating massive compute costs billed to the victim's account. Access is often resold to other actors who use it to run their own AI workloads, bypassing subscription costs and usage restrictions, while obscuring the resold access behind the original victim's infrastructure.
Remediação
Organizations are advised to monitor cloud billing and API usage for anomalies, rotate and restrict cloud credentials, apply least-privilege IAM policies, enable logging/alerting on LLM API invocations, and quickly revoke exposed keys found in code repositories or configuration leaks.
Linha do tempo
-
darkreading.com ↗ · pub. 03/11/2026 12:35 · coletado 03/11 14:00 primeiro registro só resumo do feed
LLMJacking Campaigns Expand, Reselling Stolen Cloud LLM Access Costs Victims Up to $1M
ler a análise desta fonte ocultar
Cybercriminals have industrialized LLMjacking, the practice of stealing cloud credentials to gain unauthorized access to hosted large language models (LLMs) and reselling that access to other threat actors. According to the report, attackers harvest exposed or leaked cloud API keys and credentials for services such as AWS, Azure, and Google Cloud to access LLM endpoints like Amazon Bedrock and other generative AI services, then resell proxied access through underground channels. Some victim organizations reportedly faced bills as high as $1 million in resource consumption before their cloud providers detected the abuse and revoked access. The activity represents a growing monetization vector distinct from traditional data theft, turning compromised cloud accounts into a recurring revenue stream for criminal resellers.
Technical Details
Attackers typically obtain valid cloud credentials through leaked secrets, misconfigurations, or credential-stuffing, then use them to invoke LLM APIs at scale, generating massive compute costs billed to the victim's account. Access is often resold to other actors who use it to run their own AI workloads, bypassing subscription costs and usage restrictions, while obscuring the resold access behind the original victim's infrastructure.
Remediation
Organizations are advised to monitor cloud billing and API usage for anomalies, rotate and restrict cloud credentials, apply least-privilege IAM policies, enable logging/alerting on LLM API invocations, and quickly revoke exposed keys found in code repositories or configuration leaks.