← Back to feed
2026-09-07 LLMjackingMalware TLP:CLEAR

FortiGuard Labs: LLMjacking Attack via Leaked AWS IAM Key to Monetize AI Model Access

Date: 2026-09-07
Tags: llmjacking, malware

Executive Summary

Security researchers at FortiGuard Labs uncovered a new cloud attack technique called LLMjacking, where threat actors exploit leaked AWS credentials to monetize access to premium AI models at the victim's expense. The attack begins with a compromised long-lived AWS IAM access key carrying AdministratorAccess privileges, after which the attacker creates a new IAM user within the victim's account and subscribes to high-cost foundation models via AWS Marketplace, generating inference charges billed directly to the compromised organization. In some cases, attackers also generate Bedrock service-specific API keys, providing an additional, less detectable method to invoke AI models.

Campaign Summary

FieldDetail
Campaign / MalwareFortiGuard LLMjacking Case Study (Operation Bizarre Bazaar Related)
AttributionUnknown - Criminal/Financially Motivated (confidence: medium)
TargetOrganizations with publicly exposed or leaked AWS credentials, particularly those with AWS Marketplace and Bedrock service access
VectorLeaked/exposed AWS IAM keys with administrative privileges
Statusactive
First Observed2026-09-03

Detailed Findings

Security researchers at FortiGuard Labs traced the incident to a long-lived AWS Identity and Access Management (IAM) access key carrying AdministratorAccess permissions. Once in possession of this key, the attacker created a brand-new IAM user inside the victim's account and used it to subscribe to foundation models available through AWS Marketplace, issuing CreateAgreementRequest and AcceptAgreementRequest calls against the marketplace's agreement service. With the subscription active, the attacker began invoking the models directly, generating inference charges billed entirely to the compromised organization. This attack chain represents an evolution of LLMjacking from opportunistic cost-shifting into a weaponized attack primitive targeting the AI model supply chain.

MITRE ATT&CK Mapping

TechniqueIDContext
Valid AccountsT1078Abuse of compromised AWS IAM credentials with administrative privileges to create unauthorized access and establish persistence
Resource HijackingT1496Unauthorized consumption of victim's AI model inference resources through compromised cloud credentials for financial gain

IOCs

Domains

_No specific IOCs published; attack signature is CreateAgreementRequest/AcceptAgreementRequest against AWS Marketplace followed by model invocation patterns_

Full URL Paths

_No specific IOCs published; attack signature is CreateAgreementRequest/AcceptAgreementRequest against AWS Marketplace followed by model invocation patterns_

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

AWS Marketplace
AWS Bedrock

Detection Recommendations

  1. Monitor AWS CloudTrail for CreateAgreementRequest and AcceptAgreementRequest API calls to AWS Marketplace, particularly subscription to foundation models. 2. Alert on creation of new IAM users by existing high-privilege accounts. 3. Monitor AWS Bedrock model invocation patterns for unusual volume or cross-account activity. 4. Implement AWS IAM credential rotation policies (90-day maximum lifetime for long-lived keys). 5. Enable MFA enforcement on all IAM users with AdministratorAccess permissions. 6. Use AWS Config to audit Bedrock service access and model subscriptions. 7. Monitor for unusual AWS billing changes (spike in inference costs). 8. Scan code repositories and environment variables for hardcoded AWS credentials.

References