LLMjacking Attack Steals Paid AI Model Access via Leaked AWS IAM Key

Key Takeaways

• A novel cloud attack, termed “LLMjacking,” exploits leaked AWS IAM keys to commandeer access to premium AI models.
• Attackers subscribe to expensive foundation models via AWS Marketplace, incurring substantial charges for the compromised organization.
• The unauthorized access to powerful LLMs, such as Claude 2.x and Claude 3 Opus, is then resold on underground markets.
• Since API calls appear legitimate, traditional security monitoring struggles to detect this form of abuse.
• Mitigation involves strict IAM key management, comprehensive logging (CloudTrail, Bedrock invocation), and correlating suspicious activity.

A sophisticated new cloud intrusion technique, dubbed “LLMjacking” by researchers, demonstrates how a single compromised AWS credential can be weaponized to illicitly gain access to and monetize premium artificial intelligence models. This method represents a significant shift in cloud abuse, moving beyond traditional cryptomining or data exfiltration.

Security experts at FortiGuard Labs meticulously tracked an incident that originated from a persistent AWS Identity and Access Management (IAM) access key. This particular key possessed AdministratorAccess permissions, representing the highest level of privilege attainable within an AWS account.

Upon acquiring this highly privileged key, the malicious actor proceeded to establish a new IAM user within the victim’s AWS environment. This newly created identity was then leveraged to subscribe to various foundation models available through the AWS Marketplace. The attackers initiated this process by executing CreateAgreementRequest and AcceptAgreementRequest calls against the marketplace’s agreement service, effectively binding the victim’s account to costly AI model subscriptions.

Once the subscriptions were active, the attackers began making direct invocations to these AI models, generating significant inference charges that were billed entirely to the compromised organization. In similar observed cases, attackers have also generated Bedrock service-specific API keys for the new identity. This provides an additional, less conspicuous channel for running inference calls, alongside the standard IAM credentials.

LLMjacking Attack Mechanics

LLMjacking signifies a strategic evolution in cloud-based exploitation. Rather than focusing on data exfiltration or deploying cryptocurrency miners, this technique directly monetizes the victim’s established billing relationship with their cloud service provider. The financial implications for victims are substantial, with premium models like Claude 2.x potentially costing over $46,000 per day in unauthorized usage. This daily expenditure can escalate dramatically, surpassing $100,000, if attackers utilize more advanced models such as Claude 3 Opus.

FortiGuard Labs stated that the unlawfully obtained access to these powerful AI models is frequently resold at discounted rates as AI chatbot subscriptions on platforms like Telegram and Discord. One specific operation, identified as “Operation Bizarre Bazaar,” has been linked to more than 35,000 attack sessions across over 30 different Large Language Model (LLM) providers.

A critical challenge for defenders is that these API calls originate from technically valid and properly permissioned credentials. This makes the malicious activity indistinguishable from legitimate usage at both the network and API levels, rendering it exceptionally difficult to detect using conventional monitoring systems. Given that the traffic itself is not inherently malicious, signature-based detection methods are largely ineffective against this form of abuse.

What You Should Do

• Strengthen IAM Key Management: Prioritize the use of short-lived, role-assumed credentials over long-lived, broad-scope IAM keys. Treat any non-expiring administrator keys as a critical security risk.
• Enable Comprehensive Logging: Ensure AWS CloudTrail is enabled across all accounts to capture and reconstruct the full sequence of identity creation, credential issuance, and marketplace subscription activities.
• Activate Bedrock Invocation Logging: Enable Bedrock invocation logging, which is disabled by default, to capture granular request-level details that CloudTrail alone may miss.
• Implement Correlated Monitoring: Avoid treating first-time Bedrock usage as automatically safe or suspicious in isolation. Instead, correlate such activity with other indicators like newly created identities, unfamiliar IP addresses, enumeration attempts, or spikes in access-denied errors to identify true threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.