A cloud intrusion investigated by FortiGuard Labs shows how a single exposed AWS credential can be converted into unauthorized access to expensive generative-AI services. The attacker obtained a long-lived Identity and Access Management key carrying the broad AdministratorAccess policy, then used the victim’s account to activate and consume premium foundation models. The resulting charges belonged to the compromised organization.

This abuse pattern is often called LLMjacking. Unlike cryptomining, ransomware or conventional data theft, the operator is monetizing the victim’s trusted relationship with a cloud provider. Valid credentials and ordinary API calls make the activity difficult to distinguish from an enthusiastic internal development project unless identity events, billing changes and model use are examined together.

From one key to a new cloud identity

After gaining access, the intruder created a fresh IAM user inside the account. The new identity was then used to request and accept agreements for foundation models offered through AWS Marketplace. Once those subscriptions were active, the attacker began making inference requests, generating consumption fees without needing to compromise an application already using the models.

Researchers have also seen attackers issue Bedrock-specific API keys to identities they control. That creates an additional access route alongside standard IAM credentials and may make the activity less obvious to teams focused only on the original exposed key. The initial credential was therefore not merely used for direct consumption; its administrator rights allowed the attacker to construct a durable, separate billing channel.

Why stolen model access is valuable

Premium models can generate extraordinary costs at sustained volume. FortiGuard estimated that unauthorized use of some Claude 2 variants could exceed $46,000 in a day, while higher-end Claude 3 Opus consumption could pass $100,000 daily. The economics make compromised accounts attractive to operators who resell low-cost chatbot access through messaging platforms or use the capacity for their own automated services.

One tracked ecosystem, described as Operation Bizarre Bazaar, was associated with more than 35,000 sessions spanning over 30 model providers. That scale illustrates that LLMjacking is not just opportunistic experimentation. It can support a commercial underground market in which customers receive discounted AI access while the legitimate account holder absorbs the bill.

Logging gaps can hide legitimate-looking calls

Network signatures alone are a poor fit for this problem. An inference request made with an authorized key is structurally indistinguishable from a valid request. Organizations need the surrounding context: who created the identity, where the request originated, which marketplace agreement changed and whether the account had ever used Bedrock at that volume before.

• Enable AWS CloudTrail across every account and retain records centrally.
• Turn on Bedrock model-invocation logging, which is not enabled by default.
• Alert on new IAM users followed by marketplace subscriptions or model access.
• Set cost and usage thresholds for AI services, including services not yet approved for production.
• Investigate unfamiliar IP addresses, permission enumeration and bursts of access-denied events.

Reduce the value of a leaked credential

The incident depended on a non-expiring key with sweeping privileges. Cloud teams should replace long-lived user keys with short-lived credentials obtained through role assumption wherever possible. Permissions should be limited to the services and actions a workload genuinely needs, and unused marketplace and Bedrock capabilities should be denied through organizational policies.

First-time AI usage is not automatically hostile, especially as teams experiment with new services. It becomes a strong signal when it follows suspicious identity creation, occurs from an unfamiliar location or triggers a sudden cost spike. Joining those events gives defenders a practical way to catch abuse that otherwise looks valid—and to stop a stolen secret from becoming an open-ended AI bill.