Hackers are using 'LLMjacking attacks' to hijack company AI usage and run up huge cloud bills (www.techradar.com)

Cybercriminals are increasingly engaging in "LLMjacking" attacks, where they steal AI API keys and cloud credentials to hijack expensive large language model (LLM) services for malicious purposes. According to a report from Google’s Threat Intelligence Group, these hackers not only run hefty AI workloads but also create proxy services that can lead to cloud bills skyrocketing into six digits within minutes. The schemes involve initially exploiting publicly accessible LLM endpoints or obtaining API keys before systematically escalating their access and monetizing the stolen resources. This burgeoning trend signifies a worrisome evolution in cybercrime, as it demonstrates a growing specialization within hacking groups focused on AI infrastructure. Notably, Google has observed the emergence of LLM Mixers, dedicated operators who route unauthorized LLM access and sell it on the underground market. With attackers employing sophisticated methods, such as deploying custom proxy infrastructure and containerized backdoors, organizations are urged to enhance monitoring of their LLM platforms, enforce strict access controls, and recognize any unauthorized activity as critical to maintaining cybersecurity.