'Black October': a dozen AI developer platforms breached, stolen cloud and LLM keys resold and abused on AWS Bedrock

Linha do tempo

1. securityweek.com ↗ · pub. 04/11/2026 09:43 · coletado 04/11 10:00

   Wave of AI Platform Breaches: WorkOS, Northflank, Trigger.dev, Chainstack Hit as Attackers Hunt AI Access Tokens

   ler a análise desta fonte ocultar

   A surge of attacks against AI developer and infrastructure platforms has hit at least a dozen vendors over the past month, including CommandCode, Northflank, Trigger.dev, Chainstack, WorkOS, Andromeda, Brev (NVIDIA), Fireworks AI, Lightning AI, OpenCode, Railway, Warp, and Zeabur. Attackers are primarily hunting for stored customer secrets and AI access tokens, which can be monetized through LLM-jacking and LLM broker infrastructure, according to Wiz and Cloud Security Alliance. Initial access vectors vary across incidents (compromised credentials, third-party dependencies, vulnerability exploitation), and while part of an industry-wide trend, the incidents do not appear directly related. Wiz observed multiple threat actors reusing the same compromised keys, and in some cases unauthorized activity began within 30 minutes of a reported credential breach, suggesting a robust resale market for stolen AI credentials.

   Technical Details

   Chainstack was breached on October 26 via a third-party component, exposing a database with organization names, account holder names, member email addresses, and password hashes; node credentials may also have been exposed, prompting a rotation advisory. WorkOS disclosed that on October 30 attackers compromised an internal sales application, accessing business contact details, customer communication summaries, sales data, and customer-relationship information. Both Chainstack and WorkOS attacks reportedly used the open-source AI penetration testing framework Artex for automation, a tool previously linked by multiple companies to the Chinese APT Storm-0940, including a recent campaign against ConnectWise customers. Researchers also point to distillation (training cheaper models on outputs of advanced ones) — allegedly involving Chinese AI labs — as a driver of demand for stolen AI credentials.

   Remediation

   Affected vendors have urged customers to rotate exposed credentials, including node credentials at Chainstack. Organizations using these AI developer platforms should audit and rotate any API keys/access tokens, monitor for anomalous use of inference credentials, and review third-party dependencies for compromise.

2. wiz.io ↗ · pub. 30/10/2026 19:51 · coletado 30/10 21:00 primeiro registro

   'Black October': nine AI developer platforms breached, stolen cloud and LLM keys resold and abused on AWS Bedrock

   ler a análise desta fonte ocultar

   Wiz reports that at least nine AI developer platforms disclosed security incidents in October 2026, including Railway, Lightning AI, Zeabur, Fireworks, OpenCode, Warp, Andromeda and CommandCode. Several describe an "agent swarm" attack, and OpenCode and CommandCode attribute theirs to attempted model "distillation". The attackers hunted stored environment variables, especially those granting AI access, and Wiz observed stolen enterprise AWS keys abused downstream. Two keys traced to a vendor breach were used for roughly 800k and 1.7 million Bedrock calls, likely over $100k at list price, with the traffic resembling resold coding-agent usage. Wiz links the keys to two LLM resale operations, momo and Xingjiabi, but cannot tie them directly to the original breaches.

   Technical Details

   • Root causes (self-reported): Fireworks, Zeabur and Lightning cite credential access. Railway cites "privilege escalation in our build infrastructure". Warp points to a third-party vendor dependency, and OpenCode to a "legacy system". Lightning was earlier hit by the Mini-Shai Hulud supply chain campaign. Zeabur published a full write-up and will shut down.
   • Impact: Social media reports allege ~$371,000 in crypto theft using keys stored in Railway, and consumer bills of hundreds to thousands of dollars from stolen OpenCode access.
   • Case A and B timeline: The first unauthorized activity came within 30 minutes of the vendor-side credential access. It was a single InvokeModel from a residential IP, sweeping stolen keys across organizations. Low-volume validation from a small Go client followed, then a rotating-proxy catalog probe, then boto3 enumeration of Bedrock and EC2 quotas.
   • Case A: About 800k Bedrock calls over 30 hours, ~90% successful, routed through global.* cross-region inference profiles. About three quarters of successful calls went to Opus models.
   • Case B: The key was restricted to us.* profiles. After failed attempts from a reseller pool, the same boto3 script (identical version string) from a Level 3 address made ~1.7M calls over 13 hours, with over a million successful. Nearly all the rest were throttled by regional quotas.
   • Usage profile: Heavy prompt caching and a long tail of large uncached inputs, consistent with resold coding-agent traffic.
   • momo: Operates from 23.106.46.239, which hosts the LLM resale site llm-routing.com (USDT payments) and an "ARTEX" autonomous pentest console page (Oct 8). Zeabur publicly named this IP as targeting its infrastructure (Oct 12-14). In late October it checked the Case A and B keys and attempted PutAccountDataRetention with the Case B key.
   • Xingjiabi: 38.246.114.118 (xingjiabiapi.org) enumerated and permission-checked both keys after high-volume abuse had already begun. The site also hosted a "distillation detection" scoring page. This suggests an active resale market for the keys.
   • Wiz has no evidence directly linking these IPs to the Black October breaches.

   Remediation

   • Rotate credentials and environment variables stored on affected platforms, and prioritize AI/LLM access keys and cloud keys.
   • Restrict Bedrock IAM policies to the needed cross-region inference profiles and regions, and monitor for anomalous InvokeModel and quota enumeration calls.
   • Hunt for the listed IPs and domains in cloud logs.