Affected Platforms: Amazon Web Services (AWS), Amazon Bedrock
Threat Type: Cloud credential theft, AI/LLM service hijacking ("LLMjacking")
Impacted Users: Any organization with AWS accounts
Impact: Unauthorized consumption of paid foundation-model inference, resulting in direct financial loss; potential resale of hijacked model access
Severity Level: High

Generative AI is quickly becoming one of the more lucrative uses for stolen cloud credentials. Attackers no longer need to set up crypto miners or exfiltrate data to cash in on a leaked IAM key. They can instead subscribe to foundation models through AWS Marketplace and resell inference access, a technique called LLMjacking, first documented in 2024. FortiCNAPP recently investigated a case that shows how fast and mechanical that pivot has become.

FortiGuard Labs recently analyzed a long-lived AWS IAM access key with administrator privileges that was used to create a new IAM identity, subscribe it to foundation models on AWS Marketplace, and begin invoking them.

FortiCNAPP provides coverage against attacks like this through a combination of detections and LQL policies that span the identity compromise, credential issuance, and marketplace activity involved in such a chain.

LLMjacking: Attackers Want Your Model Access, Not Your Data

LLMjacking refers to the theft and abuse of access to hosted AI models, rather than the theft of model weights or training data. The attacker's objective is simple: get another organization's cloud account to pay for expensive, high-capability model inference, then either use that access directly or resell it.

It's attractive for a few structural reasons:

• Low tooling cost, high monetization. The only prerequisite is a working cloud identity, typically a leaked access key, an exposed CI/CD secret, or a stolen local credential.
• Fast time-to-abuse. Once a cloud credential is exposed, attackers move in minutes, not days.
• Real money, fast. Premium foundation-model invocation is not cheap at scale. LLMjacking research puts victim exposure at over $46,000 per day for a Claude 2.x-class inference and past $100,000 per day once attackers move to Claude 3 Opus. Some campaigns resell stolen access as a subscription "AI chatbot" service to third parties who have no idea the underlying compute is stolen, turning a single leaked key into recurring revenue.
• It hides in plain sight. A Bedrock InvokeModel call from a compromised-but-valid IAM identity is, at the API level, indistinguishable from legitimate use. It is simply a cloud API used exactly as designed, with credentials that technically have permission to use it.
• The market has matured. What began as opportunistic credential theft has evolved into a commercial supply chain. "Operation Bizarre Bazaar" cataloged more than 35,000 attack sessions and a marketplace reselling access to 30-plus LLM providers on Telegram and Discord. This is no longer opportunistic. It has been commoditized.

The Compromise We Observed

An AWS account was compromised due to a leaked long-lived IAM access key with AdministratorAccess permissions. Using that access, the operator:

• Created a new IAM user.
• Subscribed to one or more foundation models through AWS Marketplace (CreateAgreementRequest/AcceptAgreementRequest on agreement-marketplace.amazonaws.com).
• Invoked the subscribed foundation model(s), generating inference charges against the victim account.

This class of attack typically includes an additional step to generate Bedrock service-specific credentials for the new identity via AWS's long-term API key mechanism. This is distinct from a standard IAM access key, as an alternative or to supplement invocations directly through the new user.

Recommendations for Defenders

Because LLMjacking uses valid credentials and legitimate cloud services, effective prevention and detection demand strong identity verification, thorough logging, and contextual analysis. The practices outlined below can assist organizations in minimizing their risk and spotting suspicious Bedrock activity more efficiently.

• Enable CloudTrail on every account. It's what turns a suspicious signal into a full picture: who created the identity, what credentials it issued, what it subscribed to, and in what order.
• Turn on Bedrock invocation logging in addition to CloudTrail, where feasible. It's off by default and captures request-level details that CloudTrail alone won't capture.
• Treat long-lived, broad-scope IAM keys as tier-0 risk. The entire chain in this incident depended on a single AdministratorAccess key that never expires. Prefer short-lived, role-assumed credentials wherever workloads allow it.
• Don't assume "new AI service usage" is always benign or always malicious. The right posture is corroboration. First-time Bedrock use in an account is only actionable when paired with a second signal, such as a new identity, an unfamiliar IP, enumeration behavior, or access-denied noise, not on its own.

Fortinet Protections

FortiCNAPP (Lacework) ships detection coverage relevant to this attack chain:

lacework-global-12: IAM Policy Change *(High, on by default)*. Covers privilege-escalation actions such as attaching AdministratorAccess to an identity, the step that enabled everything downstream in this case.

lacework-global-2037: Bedrock model invocation logging deleted *(High, on by default)*. Flags an operator disabling Bedrock's own audit trail, a defense-evasion step we watch for.

lacework-global-2038: Bedrock invocation throttling exceptions *(Medium, on by default)*. Fires on a Bedrock ThrottlingException: a per-event signal, not a volume threshold.

lacework-global-2906: Marketplace agreement created or accepted *(Medium, on by default)*. Flags CreateAgreementRequest/AcceptAgreementRequest on agreement-marketplace.amazonaws.com, the actual subscription step in this chain.

lacework-global-2907: IAM service-specific credential created or reset *(Medium, on by default)*. Covers Bedrock's service-specific credential mechanism directly.

lacework-global-13: IAM Access Key Change *(High, on by default)*. Covers traditional access-key creation and rotation. It does not cover Bedrock's service-specific credentials, issued through a separate API call; that's what 2907 closes.

lacework-global-14: New AWS User Created *(available, not enabled by default)*. We recommend that customers running AI workloads on AWS explicitly enable this.

lacework-global-1999 through 2002, 2781: Bedrock configuration/posture policies *(available, not enabled by default)*. These detections flag issues such as Bedrock invocation logging being disabled at the configuration level, and require no CloudTrail integration to run. They ship outside our default compliance frameworks by design (only framework-member policies are auto-enabled), so they need explicit enablement or inclusion in a custom framework to surface in compliance reporting. We recommend turning them on for any account with Bedrock access.

FortiCNAPP's broader anomaly and threat detection also covers this technique. Together, this coverage spans the full chain: the initial privilege-escalation step, credential issuance, marketplace subscription, and invocation-time abuse.

FortiGuard IP Reputation and Anti-Botnet Security Service proactively block attacks by aggregating malicious source IP data from Fortinet’s distributed network of global sensors, CERTs, MITRE, cooperative partners, and other trusted sources. This continuous intelligence enables up-to-date protection against hostile actors.

For supplementary protection capabilities, refer to Fortinet’s product catalog.

If you believe this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team for assistance.