Attackers are using leaked AWS IAM keys to hijack premium AI models, billing victims over 0k daily. Learn how LLMjacking works and how to secure your cloud.

The landscape of cloud exploitation is shifting. For years, the primary goals of attackers infiltrating cloud environments were data exfiltration or the deployment of cryptominers to hijack computing power. However, a new technique identified by FortiGuard Labs, dubbed LLMjacking, reveals a more sophisticated monetization strategy: turning a victim's billing relationship with their cloud provider into a direct revenue stream by stealing access to premium Artificial Intelligence models.

The mechanics of an LLMjacking breach

The attack chain begins with a critical failure in credential management. Researchers found that these intrusions typically start with a leaked, long-lived AWS Identity and Access Management (IAM) access key. The danger is amplified when these keys carry AdministratorAccess permissions, the highest level of privilege possible within an AWS identity. This essentially hands the attacker the keys to the entire kingdom.

Once inside, the threat actor does not immediately begin making noisy requests. Instead, they establish persistence by creating a brand-new IAM user within the compromised account. This fresh identity allows the attacker to operate independently, reducing the risk of being caught if the original leaked key is revoked. Using this new identity, the attacker interacts with the AWS Marketplace agreement service, issuing CreateAgreementRequest and AcceptAgreementRequest calls to subscribe to high-cost foundation models.

To further mask their tracks, some attackers generate Amazon Bedrock service-specific API keys for the new user. This creates a secondary, less conspicuous path for model invocation, allowing them to run inference calls alongside standard IAM credentials without triggering basic alarms.

From cloud intrusion to a black market economy

What distinguishes LLMjacking from traditional hacking is the economic model. The attacker is not interested in the company's proprietary data; they are interested in the company's credit line with Amazon. By invoking premium models, the attacker generates massive inference charges that are billed entirely to the victim organization.

This stolen compute power is then commoditized. The access is resold as bargain-priced AI chatbot subscriptions on encrypted messaging platforms and community hubs such as Telegram and Discord. This creates a scalable business model for cybercriminals, where the victim pays the wholesale cost of the AI processing while the attacker collects the retail subscription fees from end-users.

The economics are compelling: premium models such as Claude 2.x can cost victims more than 46,000 dollars per day in unauthorized usage, and that figure climbs past 100,000 dollars daily once attackers escalate to Claude 3 Opus.

Operation Bizarre Bazaar and the scale of abuse

The scope of this threat is far from isolated. Security researchers have tracked a massive operation known as Operation Bizarre Bazaar. This specific campaign has been linked to more than 35,000 attack sessions across more than 30 different LLM providers. The sheer volume of these sessions suggests a highly organized infrastructure designed to rotate through compromised accounts to avoid detection.

The difficulty in stopping these attacks lies in the nature of the traffic. Because the API calls originate from technically valid, permissioned credentials, the activity is indistinguishable from legitimate business usage at both the network and API levels. Conventional monitoring tools, which look for anomalous traffic patterns or unauthorized access attempts, often fail because the attacker is using the system exactly as it was designed—they just happen to be the wrong person using it.

Closing the vulnerability gap in AWS

To combat LLMjacking, organizations must move away from the reliance on static, high-privilege credentials. FortiGuard Labs suggests a multi-layered defense strategy focusing on visibility and the principle of least privilege. The first step is the immediate replacement of long-lived IAM keys with short-lived, role-assumed credentials, which significantly narrows the window of opportunity for an attacker if a key is leaked.

Visibility is the second pillar of defense. Many organizations leave critical logging features disabled to save on costs or reduce noise. However, in the context of LLMjacking attacks, these logs are the only way to spot the intrusion. Specifically, enabling AWS CloudTrail across all accounts allows administrators to track the creation of new identities and the acceptance of new marketplace subscriptions in real-time.

Furthermore, because Bedrock invocation logging is disabled by default, companies must manually activate it to gain request-level visibility. Without this, a company might only realize they have been breached when they receive a catastrophic billing statement at the end of the month.

Strategic defenses for the AI-driven enterprise

Beyond technical configurations, the rise of LLMjacking requires a shift in how security teams perceive AI usage. The assumption that first-time Bedrock usage is a sign of innovation or internal adoption is a dangerous blind spot. Instead, any new model subscription or a sudden spike in inference costs should be treated as a potential security event.

Organizations should implement strict monitoring for:
- The creation of new IAM users from unfamiliar IP addresses.
- Unexpected AcceptAgreementRequest calls in the AWS Marketplace.
- A sudden divergence between projected AI spend and actual billing.

As more enterprises integrate foundation models into their workflows, the surface area for these attacks grows. The transition from leaked IAM keys to financial loss happens in minutes, making proactive credential rotation the most effective deterrent.

Global implications for US and UK businesses

For entrepreneurs and CTOs in the USA and UK, LLMjacking represents a critical operational risk that transcends simple data privacy. In these markets, where rapid AI adoption is a competitive necessity, the tendency to prioritize speed over security often leads to the use of broad-scope AdministratorAccess keys during the development phase. This creates a high-value target for global threat actors.

From a regulatory and financial perspective, while the EU AI Act focuses heavily on the ethics and safety of the models themselves, US and UK firms must focus on the financial liability and governance of cloud spend. In the US, the lack of a singular federal AI law means that the burden of loss falls entirely on the enterprise; AWS is unlikely to refund charges generated by valid (albeit stolen) credentials.

UK businesses, operating under the UK GDPR, must also consider whether the creation of unauthorized IAM users constitutes a personal data breach if those users gain access to environments containing customer information. The primary lesson for the global market is clear: AI is no longer just a tool for productivity, but a new vector for financial fraud. Security must evolve from protecting the data to protecting the billing relationship.

FAQ

---

Sources: Cybersecuritynews, Cyberpress, Blog ·