A newly identified intrusion dubbed “LLMjacking” reveals how attackers can turn one compromised AWS credential into a high-dollar stream by subscribing to paid AI models using the victim’s account. The key enabler: long-lived AWS IAM access keys with AdministratorAccess privileges.
How the Attack Unfolds
Attackers begin with a leaked AWS Identity and Access Management (IAM) key that grants full administrative rights. With this elevated privilege, they spin up a fresh IAM user within the targeted organization’s account. They then use this user to call agreement APIs—such as CreateAgreementRequest and AcceptAgreementRequest—on AWS Marketplace, subscribing to foundation models like those offered via AWS Bedrock.
Once subscribed, the adversary runs inference workloads against those models, with all billing tied to the compromised organization. They may also generate Bedrock-specific API keys for stealthier usage, allowing dual paths to invoke models and hide their tracks from traditional auditing tools.
Why This Makes an Impact
LLMjacking represents a seismic shift from earlier cloud abuses like cryptomining or data theft. Instead of pilfering data or compute resources, attackers exploit billing relationships with the cloud provider itself. That translates to huge potential losses: usage of premium AI models like Claude 2.x can rack up more than US $46,000 in unauthorized charges per day, while the pricier Claude 3 Opus variant can push that figure past US $100,000 daily.
One tracked operation—dubbed Operation Bizarre Bazaar—ran over 35,000 attack sessions across more than 30 LLM providers. Stolen access is then resold on platforms like Telegram and Discord, often as “discounted” AI chatbot subscriptions. Because the API calls stem from valid credentials, they appear legitimate at the network level, making detection by signature-based tools nearly impossible.
Defensive Measures & Best Practices
Defenders are advised to fully enable AWS CloudTrail in all accounts. CloudTrail can detail identity creation, credential issuance, and Marketplace subscription activity. In addition, turning on Bedrock invocation logging—disabled by default—is vital to capture request-level detail that CloudTrail doesn’t log.
Long-lived IAM keys with broad permissions are seen as major liability. Using temporary, role-based credentials instead limits exposure. Other warning signs include: newly created identities, unknown IP addresses, enumeration behaviors, and spikes in “access denied” errors. These should trigger investigation, especially in conjunction with Marketplace usage.
AI model consumption—even for newly used services—shouldn’t be assumed safe. It becomes suspect when accompanied by odd behaviors or unexpected resource consumption. By correlating usage patterns and identity changes, organizations can better distinguish malicious usage from legitimate growth or onboarding.
This attack underscores that protecting cloud infrastructure now demands stronger focus not only on securing data and storage, but also on governance around AI-service subscriptions. As organizations adopt large language models and premium AI offerings, the ability for threat actors to monetize across marketplaces and model APIs creates a new frontier for financial exploitation. Moving forward, risk teams should treat AI model access—especially via cloud marketplaces—with the same strict guardrails as they do data access or system privileges. Vigilance, auditability, and least-privilege principles remain the best defenses.
