🎯 LLMjacking

The items that name it 8

• “Black October” for AI Developer Platforms
  writeupas techniques2026-10-30

  Theft and abuse of LLM credentials, monetised through LLM brokers and resale.

• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas classification.key entities2026-10-23
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
  writeupas classification.key entities2026-10-20
• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
  writeupas techniques2026-10-06

  Abuse of stolen cloud credentials to use LLM resources; Bedrock validation can precede larger financial impact.

• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeupas techniques2026-09-18

  Stolen cloud and AI credentials used to call models; Bedrock sequence of GetCallerIdentity, ListFoundationModels, then InvokeModel across regions

• Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
  writeupas techniques2026-09-09

  Using stolen/default LiteLLM credentials to make unauthorized API calls to configured LLM providers, running workloads on the victim organization's budget

• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas techniques2026-09-08

  Hijacking enterprise cloud infrastructure and stolen AI accounts to run unauthorized compute and AI workloads

• LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools | Sysdig
  writeupas techniques2026-06-17

  Using stolen/unauthorized access to AI model compute (originally stolen cloud credentials for paid APIs, now exposed self-hosted servers) to consume compute at the victim's expense; coined by Sysdig TRT in May 2024, evolved by 2025 into an industrialized black market via reverse-proxy infrastructure