Act
active
LLMJacking: Threat Actors Monetize Stolen Cloud LLM Credentials
- Engineer — Act: Active, multi-incident campaign causing up to $100K/day in fraudulent LLM API charges. Audit IAM roles and service accounts with LLM API access, rotate any exposed keys, and enable cloud billing anomaly alerts with low thresholds for AI/ML service spend.
- SOC/IR — Act: Mandiant-responded incidents with a clear detection surface: sudden spikes in LLM API request volume are the primary behavioral signal. Build or tune detections for abnormal AI/ML API call rates and hunt for credential exfiltration activity in cloud IAM logs since mid-2026.
- Leader — Plan: Financial exposure can reach $1M before access is revoked, affecting sectors including financial services and technology. This quarter, establish a governance policy for LLM API key issuance, enforce spend caps, and confirm billing alert thresholds cover AI service abuse scenarios.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.