/
← Voltar ao feed
high

LLMjacking: Leaked AWS Admin IAM Key Used to Subscribe to and Abuse Bedrock Foundation Models

1 fonte(s) · 1 atualização(ões) · publicado 03/09/2026 10:00 · coletado há 1 dia

FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim account. This class of attack typically also generates Bedrock service-specific credentials for a new identity through AWS's long-term API key mechanism. Because the activity uses valid credentials and legitimate cloud services, detection depends on identity verification, logging and correlating multiple signals.

Technical Details

  • Initial access: leaked long-lived IAM access key with AdministratorAccess.
  • Marketplace subscription: CreateAgreementRequest / AcceptAgreementRequest on agreement-marketplace.amazonaws.com.
  • Abuse: invocation of the subscribed foundation models, billed to the victim.
  • Persistence and alternative access: Bedrock service-specific credentials (long-term API keys) created for the new identity, distinct from standard IAM access keys.
  • The article also mentions defense evasion through deletion of Bedrock invocation logging as a step defenders watch for.
  • FortiCNAPP (Lacework) detections relevant to the chain: lacework-global-12, 13, 14, 2037, 2038, 2906, 2907, and posture policies lacework-global-1999 to 2002 and 2781.

Remediation

  • Enable CloudTrail on every account.
  • Enable Bedrock invocation logging, which is off by default.
  • Treat long-lived, broad-scope IAM keys as tier-0 risk and prefer short-lived, role-assumed credentials.
  • Corroborate first-time Bedrock use with a second signal (new identity, unfamiliar IP, enumeration behavior, access-denied noise) before acting.
  • Enable the FortiCNAPP detections that are off by default (lacework-global-14 and the Bedrock posture policies).

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 03/09/2026 10:00 · coletado 19/10 18:02 primeiro registro

    LLMjacking: Leaked AWS Admin IAM Key Used to Subscribe to and Abuse Bedrock Foundation Models

    ler a análise desta fonte

    FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim account. This class of attack typically also generates Bedrock service-specific credentials for a new identity through AWS's long-term API key mechanism. Because the activity uses valid credentials and legitimate cloud services, detection depends on identity verification, logging and correlating multiple signals.

    Technical Details

    • Initial access: leaked long-lived IAM access key with AdministratorAccess.
    • Marketplace subscription: CreateAgreementRequest / AcceptAgreementRequest on agreement-marketplace.amazonaws.com.
    • Abuse: invocation of the subscribed foundation models, billed to the victim.
    • Persistence and alternative access: Bedrock service-specific credentials (long-term API keys) created for the new identity, distinct from standard IAM access keys.
    • The article also mentions defense evasion through deletion of Bedrock invocation logging as a step defenders watch for.
    • FortiCNAPP (Lacework) detections relevant to the chain: lacework-global-12, 13, 14, 2037, 2038, 2906, 2907, and posture policies lacework-global-1999 to 2002 and 2781.

    Remediation

    • Enable CloudTrail on every account.
    • Enable Bedrock invocation logging, which is off by default.
    • Treat long-lived, broad-scope IAM keys as tier-0 risk and prefer short-lived, role-assumed credentials.
    • Corroborate first-time Bedrock use with a second signal (new identity, unfamiliar IP, enumeration behavior, access-denied noise) before acting.
    • Enable the FortiCNAPP detections that are off by default (lacework-global-14 and the Bedrock posture policies).