A newly documented cloud intrusion shows how quickly attackers can turn a single leaked AWS credential into a revenue stream by hijacking access to premium AI models, a technique researchers call LLMjacking.
Security researchers at FortiGuard Labs traced the incident to a long-lived AWS Identity and Access Management (IAM) access key carrying AdministratorAccess permissions, the highest level of privilege an AWS identity can hold.
Once in possession of this key, the attacker created a brand-new IAM user inside the victim’s account and used it to subscribe to foundation models available through AWS Marketplace, issuing CreateAgreementRequest and AcceptAgreementRequest calls against the marketplace’s agreement service.
With the subscription active, the attacker began invoking the models directly, generating inference charges billed entirely to the compromised organization. In several similar cases, attackers have also generated Bedrock service-specific API keys for the new identity, giving them a second, less conspicuous path to run inference calls alongside the standard IAM credentials.
LLMjacking Attack
LLMjacking marks a shift away from traditional cloud abuse like cryptomining or data exfiltration. Instead of stealing information, attackers monetize the victim’s billing relationship with the cloud provider itself.
The economics are compelling: premium models such as Claude 2.x can cost victims more than 46,000 dollars per day in unauthorized usage, and that figure climbs past 100,000 dollars daily once attackers escalate to Claude 3 Opus.
FortiGuard Labs stated that stolen access is frequently resold as bargain-priced AI chatbot subscriptions on Telegram and Discord, with one tracked operation, dubbed Operation Bizarre Bazaar, linked to more than 35,000 attack sessions across more than 30 LLM providers.
Because the API calls originate from technically valid, permissioned credentials, this activity looks identical to legitimate usage at the network and API level, making it exceptionally hard to catch through conventional monitoring.
Defenders cannot rely on signatures for this kind of abuse, since nothing about the traffic itself is inherently malicious. FortiGuard Labs recommends enabling AWS CloudTrail across every account to reconstruct the full sequence of identity creation, credential issuance, and marketplace subscription.
Bedrock invocation logging, which is disabled by default, should also be turned on where possible, since it captures request-level detail that CloudTrail alone misses. Long-lived, broad-scope IAM keys should be treated as a top-tier risk, given that this entire attack chain hinged on a single non-expiring administrator key; short-lived, role-assumed credentials are a far safer alternative.
Finally, organizations should avoid treating first-time Bedrock usage as automatically safe or automatically suspicious. It only becomes actionable when paired with a corroborating signal, such as a newly created identity, an unfamiliar IP address, enumeration behavior, or a spike in access-denied errors.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
