LLMjacking Attack AWS

Overview

Security researchers at FortiGuard Labs have documented a new cloud intrusion technique called LLMjacking, where attackers hijack leaked AWS credentials to steal access to premium AI models. Unlike traditional cloud abuse such as cryptomining, LLMjacking monetizes the victim’s billing relationship with AWS by running expensive inference workloads on compromised accounts.

Attack Chain

• Leaked IAM key: A long‑lived AWS IAM access key with AdministratorAccess permissions was exposed.
• New identity creation: Attackers created a fresh IAM user inside the victim’s account.
• Marketplace subscription: Using CreateAgreementRequest and AcceptAgreementRequest calls, attackers subscribed to foundation models via AWS Marketplace.
• Model invocation: Attackers ran inference calls, generating massive charges billed to the victim.
• Bedrock API keys: In some cases, attackers issued Bedrock‑specific keys for stealthier usage.

Economics of Abuse

• Premium models like Claude 2.x can cost victims $46,000 per day in unauthorized usage.
• Escalation to Claude 3 Opus pushes costs beyond $100,000 daily.
• Stolen access is resold as cheap chatbot subscriptions on Telegram and Discord.
• Operation Bizarre Bazaar: Linked to over 35,000 attack sessions across 30+ LLM providers.

Why It’s Hard to Detect

• Legitimate traffic: API calls originate from valid, permissioned credentials.
• No malicious signatures: Nothing in the traffic itself looks suspicious.
• Billing blindspot: Abuse is only visible when costs spike, often too late.

Defensive Guidance

FortiGuard Labs recommends:

• Enable AWS CloudTrail: Capture full sequences of identity creation, credential issuance, and subscriptions.
• Turn on Bedrock logging: Disabled by default, but essential for request‑level visibility.
• Avoid long‑lived IAM keys: Use short‑lived, role‑assumed credentials instead.
• Correlate signals: Treat first‑time Bedrock usage as suspicious only when paired with signals like new identities, unfamiliar IPs, or spikes in access‑denied errors.

Expert in the Cloud Insight

LLMjacking represents a new frontier in cloud abuse: attackers don’t need to steal data or mine cryptocurrency—they simply exploit billing relationships to siphon AI model access. The lesson is clear: identity hygiene is the first line of defense. Organizations must eliminate long‑lived IAM keys, enable comprehensive logging, and monitor for anomalous subscription behaviors to prevent attackers from turning cloud AI into their personal revenue stream.