Dubbed LLMjacking, this attack vector targets non-human identities (NHIs) – API keys, service accounts, and machine credentials – to bypass traditional security controls and monetize stolen generative AI access. Credential Harvesting: Automated bots scan public repositories and forums using Python scripts to detect valid credentials, with 44% of NHIs exposed via code repositories and collaboration platforms. Entro’s simulated breach revealed attackers combining automated scripts with manual reconnaissance – 63% of initial accesses used Python SDKs, while 37% employed Firefox user agents for interactive exploration via AWS console. Rapid Validation: Attackers performed initial API calls like GetCostAndUsage within 9-17 minutes of exposure to assess account value, avoiding predictable calls like GetCallerIdentity to evade detection. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security firm Entro Labs recently exposed functional AWS keys across GitHub, Pastebin, and Reddit to study attacker behavior. With attackers operationalizing leaks in under 20 minutes, real-time secret scanning and automated rotation are no longer optional safeguards but critical survival mechanisms in the LLM era. New research reveals that threat actors are exploiting exposed cloud credentials to hijack enterprise AI systems within minutes of credential leakage. Model Enumeration: Intruders executed GetFoundationModelAvailability requests via AWS Bedrock to catalog accessible LLMs – including Anthropic’s Claude and Amazon Titan – mapping available attack surfaces. Exploitation: Automated InvokeModel attempts targeted compromised endpoints, with researchers observing 1,200+ unauthorized inference attempts per hour across experimental keys. Recent incidents have demonstrated that attackers can compromise large language model (LLM) infrastructure in under 19 minutes. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 04 Mar 2025 16:25:04 +0000