It was probably inevitable. Threat researchers detected bad actors using stolen credentials to target LLMs, with the eventual goal of selling the access to other hackers.

The Sysdig Threat Research Team found new attack that targets large language model (LLM) services, known as LLMjacking.

As anybody who follows cybersecurity knows, when a new technology emerges, it’s usually followed by a threat actor trying to -jack it up. There’s clickjacking (tricking someone into hitting a disguised URL), sessionjacking (stealing a token to impersonate a user and gain their web access), and DNSjacking (redirecting someone to an attacker-controlled destination). And now, with attackers trying to take over large language models, we have…LLMjacking.

Follow us on Bluesky, Twitter (X) and Facebook at @Hackread

Since the Sysdig team discovered LLMjacking in 2024, we have discovered new methods — including rapid expansion to new LLMs, such as DeepSeek.

Join NHIcon on Jan. 28, the defining virtual event for non-human identity security, showcasing bold ideas, expert insights, and groundbreaking strategies.

Follow us on Bluesky, Twitter (X) and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Introduction: The rapid adoption of Generative AI has created a new attack surface, giving rise to "LLMjacking"—a technique where threat actors compromise cloud credentials specifically to steal large language model (LLM) quota and tokens. Unlike traditional cryptojacking which steals compute cycles for crypto mining, LLMjacking targets AI models hosted on platforms like AWS Bedrock, draining financial resources and potentially accessing sensitive data processed by the models.

FortiGuard Labs details an LLMjacking attack in which hackers used a leaked AWS admin key to subscribe to AI models and generate inference charges.

Prompt Injection in AI: Common Attack Scenarios and How to Mitigate Them

LLM jacking is an attack technique that cybercriminals use to manipulate and exploit an enterprise’s cloud-based LLMs (large language models).

Groups Conversations All groups and messages Sign in Machine Learning, Deep Learning and AI Conversations About Privacy • Terms     LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools 0 views Eyal Estrin unread, 4:07 PM (10 minutes ago)    to https://www.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Follow us on Bluesky, Twitter (X) and Facebook at @Hackread

Our research team discovered a complete LLMjacking supply chain. Attackers scan for exposed AI endpoints, validate access through systematic API testing, then resell discounted access to compromised infrastructure...

CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.

ChatGPT, Google Gemini, oder Apple Intelligence – künstliche Intelligenz hat längst seinen Weg in den Alltag gefunden. Die zunehmende Beliebtheit zieht aber auch Cyberkriminelle an. Eine neue Masche bahnt sich an: LLMjacking-Angriffe. Was bisher bekannt…

Our research team discovered a complete LLMjacking supply chain. Attackers scan for exposed AI endpoints, validate access through systematic API testing, then resell discounted access to compromised i...

Over 175,000 publicly exposed Ollama AI servers across 130 countries, with many enabling tool calling that allows code execution and LLMjacking abuse.