Hackers Exploit AI Infrastructure to Steal API Keys, Gain Persistence and Mine Cryptocurrency

Key Takeaways

• Attackers are increasingly targeting AI infrastructure, including gateways, retrieval tools, and workflow services, to gain access to corporate systems.
• Compromises of LiteLLM, RAGFlow, and Kestra demonstrate a pattern of API key theft, persistence establishment, and cryptocurrency mining.
• The attack chains leverage vulnerabilities like CVE-2026-42271, CVE-2026-48710, and CVE-2026-49869.
• Security teams must prioritize patching AI services, securing sensitive credentials, and monitoring for unusual activity or resource consumption.

Cybercriminals are pivoting their focus, increasingly exploiting vulnerabilities within artificial intelligence platforms to infiltrate critical corporate networks. Recent research from Microsoft reveals that exposed AI gateways, data retrieval tools, and workflow automation services can serve as direct conduits for attackers to obtain provider credentials, access databases, compromise container environments, and leverage powerful computing resources for illicit activities.

This evolving threat landscape has manifested in attacks against three distinct AI-related services: LiteLLM, RAGFlow, and Kestra. While the initial compromise vectors varied across these incidents, the attackers consistently followed a well-established strategy for monetization: exfiltrating sensitive data, maintaining long-term access, and deploying cryptocurrency miners or engaging in other forms of abuse on the compromised servers.

These AI services have emerged as critical control points within modern IT infrastructures. Microsoft said in a report that this trend signifies a notable shift in attacker priorities. Instead of exclusively targeting end-users or traditional cloud servers, malicious actors are now actively probing the foundational infrastructure that connects applications to large language models (LLMs), databases, and automation workflows. For cybersecurity teams, unexplained surges in AI resource consumption should now trigger the same level of alarm as the sudden billing spikes observed in AI token jacking incidents.

Hackers Exploit AI Infrastructure

In one notable case involving LiteLLM, Microsoft’s analysis indicated with high confidence that attackers likely exploited an exposed gateway. This compromise chain involved the exploitation of two vulnerabilities: CVE-2026-42271 and CVE-2026-48710.

The initial malicious payload was designed to scan the container’s main process environment, specifically searching for API keys, access tokens, passwords, and database credentials. Subsequently, this information was exfiltrated using various tools, providing the attackers with redundant pathways for data egress, even if certain utilities or outbound routes were blocked.

Following this initial data exfiltration, the attackers downloaded an ELF payload, storing it in a temporary directory and renaming it to masquerade as a legitimate Linux service. They then conducted reconnaissance on the host, examined open network ports, searched for any competing cryptocurrency miners, and accessed LiteLLM’s PostgreSQL-backed records.

This attack methodology closely mirrors previous incidents targeting container environments, where unsecured management interfaces have been leveraged to gain direct access to the underlying host. A similar pattern was observed in a Docker endpoint mining campaign, where cryptojackers successfully stole secrets, established persistent access mechanisms, and eliminated rival miners after compromising a cloud workload.

RAGFlow experienced a different form of exploitation. Microsoft detected potential server-side request probing, which was followed days later by successful code execution. Attackers then inserted a hidden Python hook into the application’s LLM configuration path. This hook was designed to covertly capture API keys, model names, provider types, and endpoint details whenever an administrator configured a new provider.

Persistence and Mining Risks

The Kestra incident involved the likely exploitation of CVE-2026-49869, a critical authentication bypass vulnerability. This flaw enabled attackers to create a malicious workflow that executed shell commands on the worker. They proceeded to inspect the Docker socket and gather container environment data, before downloading and running XMRig to mine Monero cryptocurrency, utilizing the victim’s CPU resources.

A significant challenge in these intrusions was the attackers’ establishment of persistence, making remediation efforts considerably more complex. Microsoft documented various persistence mechanisms, including modifications to service-account SSH keys, cron job manipulation, the deployment of hidden temporary relays, naming malicious files to resemble legitimate services, creating restart loops, and setting immutable file attributes.

For instance, RAGFlow’s altered startup path ensured that its credential-stealing hook would reload upon service restarts. Similarly, the Monero miner deployed in the Kestra incident was configured to survive the termination of the original shell session.

What You Should Do

• Patch AI Services Immediately: Prioritize applying security updates and patches to all exposed AI services, gateways, and related infrastructure components.
• Rotate API Keys and Credentials: Promptly rotate any API keys, tokens, or credentials that were connected to a reachable or compromised gateway. Assume compromise for any credentials accessible through the affected services.
• Review Database and Account Activity: Scrutinize database access logs and provider-account activity for any anomalous or unauthorized actions.
• Monitor for Unusual Processes: Implement robust monitoring for unexpected shell or Python processes initiated by AI applications, particularly those coinciding with secret access attempts, modifications to application files, or unusual outbound network connections.
• Secure AI Gateways: Treat AI gateways as repositories for highly sensitive secrets. Enforce strong authentication for all application and management interfaces.
• Restrict Network Access: Keep administrative ports off the public internet and place databases behind private, highly restrictive network paths.
• Managed Secrets Systems: Store provider keys in a dedicated, managed secrets system instead of relying on process environment variables. Utilize separate, limited-purpose virtual keys and enforce spending limits for different teams.
• Default-Deny Outbound Connections: Implement a default-deny policy for all outbound network connections, limiting them strictly to essential services.
• Enhance Logging and Monitoring: Log DNS callbacks, raw-IP traffic, changes to SSH authorized_keys and cron jobs, and execution from writable temporary folders to detect attack chains early.
• Fast Revocation and Usage Monitoring: Establish rapid revocation procedures and continuous usage monitoring for API keys, especially after they leave their intended secure environment, to mitigate the impact of credential theft.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.