**LLMjacking: AI Model Hijacking Reaches Black Market Scale**

> LLMjacking: AI Model Hijacking Reaches Black Market Scale Cloud Security Alliance AI Safety Initiative | Research Note | March 15, 2026 --- Key Takeaways LLMjacking — the unauthorized use of cloud-hosted LLM resources through compromised credentials, exposed APIs, or unauthenticated endpoints — has ... LLMjacking: AI Model Hijacking Reaches Black Market Scale Authors: Cloud Security Alliance AI Safety Initiative Published: 2026-03-15 Categories: AI Security, Cloud Security, Threat Intelligence, Credential Security, Financial Risk Download PDF LLMjacking: AI Model Hijacking Reaches Black Market Scale Cloud Security Alliance AI Safety Initiative | Research Note | March 15, 2026 Key Takeaways LLMjacking — the unauthorized use of cloud-hosted LLM resources through compromised credentials, exposed APIs, or unauthenticated endpoints — has evolved from a novel proof-of-concept threat first documented by Sysdig in May 2024 into a commercially structured criminal enterprise with documented marketplace infrastructure by early 2026 \[1\]\[2\]. Operation Bizarre Bazaar, jointly reported by Sysdig and Pillar Security Research in February 2026 \[2\]\[3\], is the first publicly documented LLMjacking campaign to feature systematic attribution, full supply chain documentation, and confirmed marketplace monetization: researchers captured 35,000 attack sessions between December 2025 and January 2026 (averaging 972 attacks per day) against honeypot infrastructure \[3\]. The criminal infrastructure consists of a three-stage supply chain — automated reconnaissance using Shodan and Censys, quality-based endpoint validation, and commercial resale — culminating in the silver.inc underground marketplace, which resells unauthorized access to more than 30 LLM providers at 40–60% discounts via Telegram and Discord, accepting cryptocurrency and PayPal \[3\]. Victim organizations face financial losses that Sysdig researchers estimated could reach $46,000 per day for credential theft against AWS Bedrock at peak quota consumption \[1\], with one commercial assessment projecting potential exposure exceeding $100,000 per day when targeting the most capable frontier models \[4\]. A secondary MCP-focused campaign, distinct from the primary LLMjacking operation, accounted for 60% of total attack traffic against honeypot infrastructure by late January 2026, suggesting that attackers have begun targeting Model Context Protocol server endpoints as both an LLM access vector and a potential lateral movement pathway into broader enterprise infrastructure \[3\]. Background When Sysdig&\#8217;s Threat Research Team published the original LLMjacking research in May 2024, the threat category was genuinely novel. Researchers had discovered attackers exploiting CVE-2021-3129 \[1\], a known remote code execution vulnerability in outdated Laravel installations, to steal cloud credentials and use them specifically to access cloud-hosted large language model services \[1\]. The use case was economically motivated but organizationally narrow: the attacker script validated stolen credentials against ten distinct AI platforms — AI21 Labs, Anthropic, AWS Bedrock, Azure, ElevenLabs, MakerSuite, Mistral, OpenAI, OpenRouter, and GCP Vertex AI — and was designed to enable the attacker to consume inference capacity at the victim&\#8217;s expense while reselling that access to paying customers through reverse proxy infrastructure \[1\]. The term &\#8220;LLMjacking&\#8221; was coined to describe this intersection of credential theft and AI resource abuse, distinguished from prior forms of cloud infrastructure hijacking (cryptojacking, for instance) by the specific targeting of language model services and the unique fin...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：行业
- **发布时间**：2026-09-12 04:19（北京时间）
- **原文**：[打开原文](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-black-market-ai-model-hijacking)