[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjAvlzMZKAuwP73QK9XBrH-kBkOT-SKQGgq9qFyKWZ3s":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"03b7dfc6-43d6-456e-815e-7aed2e220f63","LLMJacking Emerges as Thriving Cybercriminal Enterprise","llmjacking-emerges-as-thriving-cybercriminal-enterprise-f81274","Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.","A new criminal enterprise, dubbed 'LLMJacking', has emerged where threat actors gain unauthorized access to cloud-based Large Language Models (LLMs) and then resell this access to other malicious actors. Victims have reported significant financial losses, with some incurring costs up to $1 million in cloud resource consumption before their access was revoked.","Cybercriminals are reselling cloud access to LLMs, costing victims up to $1M.","https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Fllmjacking-thriving-cybercriminal-enterprise","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltbc06310368e21110\u002F6a4bdbe6a6d4757864059ce1\u002Fllm-Boy_Wirat-Getty-2149059417.jpg?width=720&quality=80&disable=upscale","2026-11-03T15:35:50+00:00","2026-11-03T17:00:30.875232+00:00",7,[17],{"name":18,"type":19},"LLM","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":126},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":72,"name":73,"problem":74,"products":75},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,110,118],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":106,"product_name":107,"url":108,"description":109},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":139},"llmjacking-stolen-cloud-ai-credentials-fuel-a-million-dollar-criminal-economy","LLMJacking: Stolen Cloud AI Credentials Fuel a Million-Dollar Criminal Economy","LLMJacking occurs when threat actors steal valid cloud credentials or API keys granting access to expensive Large Language Model services, then resell that access to other criminals while the victim foots the bill. The root cause is weak access control over cloud-based AI resources — credentials are over-privileged, poorly rotated, or exposed through misconfigured environments. Victims only discover the breach after catastrophic billing spikes, revealing a critical gap in real-time monitoring and anomaly detection for cloud resource consumption. This matters because the financial damage can reach seven figures before any response is triggered, and the stolen access enables downstream criminal activity including AI-generated phishing, malware, and disinformation at scale.",[132,133,134,135,136,137,138],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIST CSF 2.0 DE.AE: Adverse Event Analysis",{"CIS Control 8: Audit Log Management":140,"NIST SP 800-53 SI-2: Flaw Remediation":141,"CIS Control 6: Access Control Management":142,"NIST CSF 2.0 DE.AE: Adverse Event Analysis":143,"CIS Control 17: Incident Response Management":144,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":145,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":146},"Victims discovered the breach only after massive billing spikes; consistent collection and review of cloud service audit logs would have surfaced anomalous API usage patterns far earlier in the attack lifecycle.","Where credential exposure stems from vulnerable application code or misconfigured pipelines, timely identification and remediation of those flaws is essential to closing the initial access vector used in LLMJacking campaigns.","Proper management of cloud API keys, enforcement of least-privilege access, and timely revocation of unused credentials — all required by this control — would have severely limited an attacker's ability to hijack and resell LLM access.","Detecting LLMJacking requires correlating anomalous cloud usage telemetry into actionable alerts; this control specifically calls for the analysis of events and anomalies to identify potential cybersecurity incidents before significant harm occurs.","Organisations lacked automated response playbooks to revoke compromised credentials or cap cloud spending in real time; a mature incident response capability would have contained damage well before costs reached seven figures.","This control requires organisations to identify and address technical vulnerabilities — including insecure credential storage and overly permissive cloud configurations — that enable attackers to harvest the API keys used in LLMJacking.","LLMJacking succeeds because stolen or leaked credentials grant unchallenged access; this control mandates strong identity verification, least-privilege, and credential lifecycle management that would have prevented unauthorized use of cloud AI keys."]