LLMjacking Attack Leverages Leaked AWS Credentials to Monetize Paid AI Model Access
Attackers are exploiting leaked AWS IAM keys to hijack access to expensive AI models, a technique dubbed LLMjacking, leading to significant unauthorized inference charges for victim organizations.
A novel cloud intrusion technique, termed LLMjacking, has emerged where attackers monetize stolen cloud credentials by hijacking access to premium AI models. Security researchers at FortiGuard Labs uncovered an incident where a long-lived AWS Identity and Access Management (IAM) access key with AdministratorAccess permissions was compromised. The attacker leveraged this key to create a new IAM user within the victim's AWS account.
Once the new identity was established, the attacker proceeded to subscribe to various foundation models available through the AWS Marketplace. This was achieved by issuing CreateAgreementRequest and AcceptAgreementRequest calls to the marketplace's agreement service. Following successful subscription, the attacker began invoking these premium AI models, generating substantial inference charges that were billed directly to the compromised organization.
In some instances, attackers have also created Bedrock service-specific API keys for the newly created IAM user. This provides an alternative, less conspicuous method for running inference calls, complementing the use of standard IAM credentials and further complicating detection efforts. This attack vector represents a shift from traditional cloud abuse, such as cryptomining or data exfiltration, focusing instead on directly monetizing the victim's billing relationship with the cloud provider.
The economic incentives for LLMjacking are significant. Premium AI models like Claude 2.x can incur costs exceeding $46,000 per day for unauthorized usage, with more advanced models like Claude 3 Opus potentially costing over $100,000 daily. Researchers have observed that stolen access is often resold as discounted AI chatbot subscriptions on platforms like Telegram and Discord, with one tracked operation, 'Operation Bizarre Bazaar,' linked to over 35,000 attack sessions across more than 30 AI model providers.
A critical challenge in detecting LLMjacking is that the malicious API calls originate from technically valid, permissioned credentials. This makes the activity indistinguishable from legitimate usage at the network and API level, rendering conventional monitoring tools ineffective. Defenders cannot rely on signature-based detection, as the traffic itself does not exhibit inherently malicious characteristics.
To combat this threat, FortiGuard Labs recommends several security best practices. Enabling AWS CloudTrail across all accounts is crucial for reconstructing the full sequence of events, including identity creation, credential issuance, and marketplace subscriptions. Additionally, Bedrock invocation logging, which is disabled by default, should be activated to capture request-level details that CloudTrail might miss.
Organizations should also treat long-lived, broad-scope IAM keys as a high-tier risk, given that this entire attack chain was predicated on a single, non-expiring administrator key. The adoption of short-lived, role-assumed credentials is a significantly safer alternative. Furthermore, initial Bedrock usage should not be automatically classified as safe or suspicious; its legitimacy can only be determined when correlated with other signals, such as newly created identities, unfamiliar IP addresses, enumeration behaviors, or a spike in access-denied errors.