Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials

Summary

Attackers reportedly exploited stolen cloud credentials obtained through a vulnerable Laravel system (CVE-2021-3129) to allegedly abuse AI cloud services, including Anthropic’s Claude and AWS Bedrock, in a scheme referred to as “LLMjacking.” The attackers are said to have monetized access through reverse proxies, reportedly inflating victim costs to as much as $100,000 per day. Additionally, they allegedly bypassed sanctions, enabled LLM models, and evolved techniques to evade detection and logging.

Developers

• OAI Reverse Proxy Tool Creators
• LLMjacking Reverse Proxy Tool Creators

Deployers

• LLMjacking Attackers Exploiting Laravel
• Entities engaging in Russian sanctions evasion

Harmed parties

• Laravel users
• Laravel CVE-2021-3129 users
• Cloud LLM users
• Cloud LLM service providers