LLMjacking: Hackers Stealing Cloud AI Resources

📅 November 13, 2026  |  🏷 Cyber Security  |  Cyber Security, Information Security, Threat Management

A single compromised cloud credential is now worth more to attackers than a stolen credit card number. Security researchers at Sysdig documented a case in 2024 where threat actors racked up $46,000 in Claude API charges within 30 minutes using stolen AWS credentials — charges billed entirely to the victim organization. Welcome to the era of LLMjacking: a sophisticated, fast-moving attack class where hackers don’t want your data. They want your AI.

LLMjacking represents a sharp evolution in cloud resource abuse. Unlike cryptojacking — which hijacks compute power to mine cryptocurrency — LLMjacking targets something far more expensive: access to large language models hosted on cloud AI platforms. The economics are brutal. A single hour of inference time on a frontier model can cost hundreds of dollars. At scale, an attacker running unauthorized AI workloads through a victim’s credentials can generate bills that exceed a small company’s quarterly IT budget before anyone notices the anomaly.

This isn’t a theoretical threat. It is happening now, accelerating in sophistication, and exploiting gaps that exist in virtually every organization that has adopted cloud-hosted AI services — which, by late 2026, is most of them.

What Is LLMjacking and How Does It Work?

LLMjacking is the unauthorized use of cloud-hosted large language model APIs through stolen or compromised credentials. The term was coined by researchers at Sysdig’s Threat Research Team in mid-2024 and has since entered mainstream security lexicon as the attack pattern proliferated across AWS Bedrock, Google Vertex AI, Azure OpenAI Service, and direct API access to providers like Anthropic and OpenAI.

The attack chain is deceptively simple. Threat actors acquire valid API keys or cloud IAM credentials — often through scanning public repositories, exploiting vulnerable web applications, or purchasing them on dark web marketplaces. Once in possession of valid credentials, they verify which AI model access the account has enabled, then systematically query those models for their own purposes. The victim pays the inference bill; the attacker gets the AI capability.

The Credential Acquisition Pipeline

Sysdig’s original research identified that attackers frequently used scanning tools — specifically customized versions of Nuclei templates — to probe publicly accessible web applications for exposed environment variables and configuration files containing API keys. GitHub remains a persistent source of leaked credentials, despite automated secret scanning tools. In one documented campaign, attackers compromised over 100 victim accounts within a single week, all sourced from a targeted repository scan.

Beyond repository scanning, Initial Access Brokers (IABs) now explicitly list cloud AI credentials as a product category. Forum posts on dark web markets in 2025 showed tiered pricing for credentials based on which AI models the account had access to — Claude Opus access commanding a significant premium over GPT-3.5-class access, reflecting the direct monetization potential the attacker perceives.

Verification Before Exploitation

A critical and often overlooked phase is the verification step. Sophisticated LLMjacking operations don’t immediately hammer the API after credential theft. They make a minimal, targeted call — often requesting the model list or sending a low-token test prompt — to confirm access is live and identify which models are available. This keeps initial activity below alerting thresholds. Only after verification do they escalate to heavy usage. This behavior pattern means that many organizations see only a single anomalous API call in their logs before costs suddenly explode.

Who Is Running These Attacks and Why

The motivations behind LLMjacking are more varied than initial reports suggested. Early analysis pointed primarily to financially motivated actors seeking to resell AI access — essentially running “AI-as-a-service” storefronts powered by stolen credentials. But the threat landscape has matured significantly.

By 2026, researchers at CrowdStrike and Recorded Future have identified at least four distinct actor categories: financially motivated cybercrime groups reselling API access; nation-state affiliated actors using hijacked AI resources for intelligence production without attribution; hacktivists using high-volume API calls to generate propaganda or disinformation at scale; and offensive security tool developers using stolen compute to train or fine-tune models for malicious purposes, including phishing kit generation and social engineering scripts.

The Underground AI Economy

Telegram channels and dark web forums now offer subscription services built entirely on stolen AI credentials. For as little as $20 per month, criminal subscribers get access to frontier AI models — Claude 3.5 Sonnet, GPT-4o, and Gemini Ultra class systems — with zero attribution risk. The service provider handles credential rotation as accounts are burned, maintaining service continuity. This is an enterprise-grade criminal operation with a support model.

The financial logic is compelling from the attacker’s perspective. If a threat actor can steal credentials providing $10,000/month in AI inference budget and resell that access to 50 subscribers at $200 each, they net $10,000 in pure margin while the victim organization absorbs the cloud bill. The return on investment for the initial credential theft — often measured in minutes of work — is extraordinary.

Detection Challenges: Why LLMjacking Is Hard to Catch

Cloud AI usage doesn’t have the same detection fingerprints as cryptomining. Cryptomining produces sustained, high CPU/GPU utilization with distinctive network patterns — relatively easy to detect with behavioral analytics. LLMjacking looks, at the API layer, like normal application traffic. The requests come from valid credentials. The API calls follow legitimate request formats. Without specific AI-aware monitoring policies, the first indicator an organization receives is often a cloud billing alert — if they’ve configured one.

A 2025 Cloud Security Alliance survey found that 67% of organizations using cloud AI services had no specific monitoring policies for AI API usage anomalies. The same survey found that 41% had no spending alerts configured for their AI services at all. This detection gap is the structural vulnerability that LLMjacking operations exploit.

The Logging Problem

Many organizations that do enable cloud logging don’t capture the specific data needed to detect LLMjacking. AWS CloudTrail logs IAM activity, but model invocation logs for Bedrock require a separate opt-in configuration that is not enabled by default. Azure’s OpenAI service requires Diagnostic Settings to be explicitly configured to capture request-level telemetry. The same pattern holds across GCP’s Vertex AI. Attackers have learned that the default logging posture in most cloud environments leaves significant blind spots specifically around AI API activity.

Furthermore, LLMjacking requests often originate from geographically distributed exit nodes — residential proxies, compromised home routers, or Tor exit nodes — making IP-based anomaly detection unreliable. A request coming from a residential ISP in Germany is not inherently suspicious. Without request-volume and cost-velocity analytics, the malicious nature of the traffic is invisible.

Specific Attack Variants and Emerging Techniques

LLMjacking has not remained static. As defenders have begun implementing basic controls, attackers have adapted. Understanding current and emerging variants is essential for maintaining an effective defensive posture.

Reverse Proxy Jacking

An increasingly common variant involves deploying a reverse proxy layer between stolen credentials and downstream subscribers. Rather than directly exposing API keys to customers in their underground service, operators deploy lightweight proxy servers — often on compromised VPS instances — that accept requests from subscribers and relay them to the legitimate API using the stolen credentials. This architecture provides operational resilience: if one set of credentials is burned, the operator swaps them out at the proxy layer without disrupting subscribers. Organizations investigating unusual API activity may trace traffic back only to the proxy, not to the actual end consumers.

Model Exfiltration and Fine-Tuning Abuse

A more technically sophisticated variant involves using hijacked cloud credentials not just for inference but for fine-tuning operations. Fine-tuning a large model on specialized datasets — malware behavior patterns, phishing template corpora, disinformation narratives — is computationally expensive. By hijacking an organization’s cloud AI credentials, attackers can conduct this training at the victim’s expense, then exfiltrate the resulting fine-tuned model weights for use in their own infrastructure. This represents a significant escalation: the attacker walks away not just with AI access, but with a customized AI capability they now own outright.

In one case documented by researchers at Trail of Bits in early 2026, a threat actor used a compromised enterprise account to run approximately 340 fine-tuning jobs over three weeks, generating over $180,000 in cloud charges, before detection. The fine-tuned models produced were assessed to be optimized for generating highly convincing spear-phishing content.

Building a Defense Architecture Against LLMjacking

Effective defense against LLMjacking requires layering controls across the credential management, monitoring, and policy enforcement domains. No single control is sufficient — the attack surface spans multiple cloud services, development workflows, and third-party integrations.

Credential Hygiene and Least-Privilege IAM

The foundational control is rigorous credential hygiene. API keys and IAM credentials that have access to AI services should follow strict least-privilege principles: scoped to the minimum set of models, regions, and operations required for the legitimate use case. If an application only needs to call a specific text generation model, its credentials should be blocked from invoking image generation, fine-tuning, or model listing endpoints at the IAM policy level.

Specific recommended actions include:

• Rotate API keys on a fixed schedule (90 days maximum for long-lived keys; prefer short-lived tokens where the platform supports it)
• Use AWS IAM Conditions to restrict Bedrock API calls to specific source VPC endpoints, eliminating the viability of external credential abuse
• Enable AWS Bedrock model invocation logging explicitly — it is not on by default
• Deploy GitHub Advanced Security or equivalent secret scanning on all repositories, with push protection enabled to block commits containing credential patterns
• Audit third-party integrations that hold AI service credentials — LLM orchestration frameworks, CI/CD pipelines, and customer-facing AI features are common exposure points

Behavioral Monitoring and Cost Controls

Monitoring must be AI-aware. Standard SIEM rules tuned for traditional cloud workloads will not catch LLMjacking reliably. Required monitoring capabilities include:

• Token velocity alerting: Alert when API token consumption exceeds baseline by more than 2x within any 15-minute window
• Geographic anomaly detection: Flag API calls from IP blocks inconsistent with the application’s normal geographic footprint
• Billing velocity controls: Configure cloud provider budget alerts at both 50% and 80% of expected monthly AI spend — not just at 100%
• Model access auditing: Alert on API calls to models the organization has not explicitly approved for use — unauthorized model invocations are a strong indicator of credential compromise
• Fine-tuning job monitoring: Any fine-tuning job initiation should trigger mandatory review — these are high-cost, high-risk operations that should require explicit authorization

Cloud providers are beginning to offer native controls in this area. AWS now provides Bedrock Guardrails with usage policy enforcement capabilities. Azure offers Azure AI Content Safety integration with Azure Monitor for anomaly detection. Organizations should evaluate these native capabilities as part of their defense stack rather than relying exclusively on third-party tooling.

Regulatory and Compliance Implications

LLMjacking creates compliance exposure that extends well beyond the financial impact of fraudulent cloud charges. When attackers use your AI credentials, they may be sending data — including data passed through your AI-integrated applications — to systems you no longer control. If customer data, PII, or regulated information flows through an AI pipeline that has been compromised, you may have a reportable breach under GDPR, HIPAA, CCPA, or applicable sector regulations, even if the primary incident was credential theft rather than a classic data exfiltration.

The EU AI Act, which entered full enforcement in 2026, introduces additional complexity. Organizations operating AI systems classified as high-risk are required to maintain audit trails of model usage and ensure that model access is restricted to authorized purposes. A successful LLMjacking attack that results in unauthorized model use could constitute a compliance violation independent of any data exposure, potentially triggering notification requirements and regulatory penalties.

Incident Response Playbook Gaps

Most incident response playbooks have not been updated to address LLMjacking as a specific scenario. The response actions differ materially from a standard credential compromise: in addition to revoking and rotating credentials, responders need to audit model invocation logs for data exposure risk, assess whether fine-tuning jobs were initiated (and what data was used), notify cloud providers to assist with forensic log preservation, and evaluate whether cost recovery or fraud claims against the cloud provider are viable. Some providers have begun offering limited cost forgiveness programs for verified LLMjacking victims — but these programs require prompt reporting and documentation.

Key Takeaways

• LLMjacking is a financially devastating, rapidly evolving attack class that exploits the high cost of cloud AI inference to generate massive fraudulent charges — often before any alert fires.
• The detection gap is structural: default logging configurations on AWS Bedrock, Azure OpenAI, and GCP Vertex AI do not capture sufficient telemetry to detect credential abuse without explicit opt-in configuration.
• Fine-tuning abuse represents a significant escalation — attackers can use your credentials to build customized malicious AI capabilities at your expense, then retain those capabilities permanently.
• Defense requires AI-specific controls: token velocity alerts, model access auditing, and geographic anomaly detection tuned for AI API traffic patterns, not generic cloud workload baselines.
• Compliance exposure extends beyond financial loss: GDPR, HIPAA, and EU AI Act obligations may be triggered by LLMjacking incidents independent of whether traditional data exfiltration occurred.

Conclusion: The Window to Get Ahead of This Is Narrow

LLMjacking is not an emerging threat waiting to mature — it is an active, well-organized criminal economy operating at scale. The combination of expensive AI infrastructure, immature default logging postures, and the explosion of AI-integrated enterprise applications has created an attack surface that most organizations have not yet seriously evaluated.

The organizations that will weather this threat class successfully are those that treat AI API credentials with the same rigor they apply to production database credentials or privileged administrative accounts — not as development convenience tokens left in environment files and forgotten.

Your immediate action items: Audit every AI service credential in your environment this week. Enable model invocation logging on every cloud AI platform you use. Configure billing velocity alerts at 50% of expected monthly AI spend. Review your incident response playbook and add a LLMjacking scenario with explicit steps for model invocation log review and fine-tuning job audit. If you use a CI/CD pipeline that touches AI credentials, enable secret scanning with push protection today — not at the next sprint cycle.

The organizations that treat AI security governance as a first-class discipline now will avoid the painful, expensive lesson that credential theft in the AI era carries consequences that extend far beyond a single compromised account.