Press play to start listening
FortiGuard Labs recently analyzed the compromise of an Amazon Web Services (AWS) account used to access paid AI models through Amazon Bedrock. The attackers entered the account using a leaked AWS Identity and Access Management (IAM) access key, then subscribed to foundation models and invoked them.
The incident is an example of LLMjacking, a term coined by Sysdig in 2024 for the unauthorized use of hosted AI models through compromised credentials. FortiGuard Labs shared details of the incident in a recent research post, which was also shared with Hackread.com.
How the Attack Started
The attackers got into the AWS account using a leaked IAM access key. The key was long-lived and had AdministratorAccess permissions, which gave them access to carry out further actions in the account.
They then used AWS Marketplace agreement requests, including CreateAgreementRequest and AcceptAgreementRequest, to subscribe to foundation models. Next, they invoked the models, with the resulting inference charges billed to the compromised account.
Fortinet said attacks of this type typically include creating Bedrock service-specific credentials. However, it did not report that this step occurred in the incident it analyzed. Because the attackers use valid credentials and legitimate cloud services, the activity can blend into normal API traffic.
“A Bedrock InvokeModel call from a compromised-but-valid IAM identity is, at the API level, indistinguishable from legitimate use,” stated FortiGuard Labs.
The Cost of LLMjacking
The stolen access can be used directly or resold. In January, Pillar Security reported Operation Bizarre Bazaar, a campaign that captured 35,000 attack sessions targeting exposed AI infrastructure. The operation also included a marketplace offering access to more than 30 LLM providers through Telegram and Discord.
Sysdig calculated that maximum-quota abuse of Claude 2.x across multiple AWS regions could cost a victim more than $46,000 per day. Later research estimated that abuse involving Claude 3 Opus could exceed $100,000 per day.
A separate API-key theft disclosed by AI research organization METR shows how large unauthorized model usage can become, although METR did not incur the estimated cost. METR said attackers stole an API key in March and used it for three weeks to consume credits worth approximately $600,000. The credits provided access to publicly available models and had been granted to METR free of charge by the model developer.
FortiGuard Labs recommends turning on AWS CloudTrail and Bedrock invocation logging to track activity, and replacing long-lived administrator keys with short-lived credentials where possible.
