LLMjacking attack exploits leaked AWS keys to steal AI access

Security researchers have documented a new attack vector termed LLMjacking, where threat actors exploit leaked AWS IAM credentials to illicitly subscribe to premium AI foundation models. According to a report by The Cyber News, attackers utilized a long-lived AdministratorAccess key to create unauthorized IAM users within victim accounts and execute marketplace agreement requests. This method allows criminals to convert stolen cloud credentials into immediate revenue streams by accessing paid generative AI services without direct payment. The incident highlights critical vulnerabilities in how cloud marketplaces validate subscription authority versus infrastructure permissions. Security experts warn that standard IAM policies often fail to restrict marketplace purchasing capabilities even when administrative access is compromised. Organizations are advised to audit long-lived keys and implement granular permission boundaries specifically for AI service procurement to mitigate this emerging financial risk.