{
 "id": "AIR-2025-0056",
 "slug": "threat-actors-hijack-cloud-hosted-llms-via-stolen-credential",
 "title": "Threat Actors Hijack Cloud-Hosted LLMs via Stolen Credentials",
 "summary": "Malicious actors utilized stolen credentials to access cloud-hosted large language models and created a reverse proxy for illegal resale. The activity impacted various cloud services and AI providers.",
 "type": "attack_on_ai",
 "categories": [
  "other",
  "data_leak"
 ],
 "severity": 3,
 "targets": [
  "OpenAI",
  "Anthropic",
  "Mistral",
  "Amazon",
  "Google",
  "framework_or_tooling"
 ],
 "products": [
  "AWS Bedrock",
  "Azure AI",
  "GCP Vertex AI"
 ],
 "incident_date": "2024-05-06",
 "incident_date_precision": "day",
 "first_reported": "2025-04-22",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0030",
   "publisher": "MITRE ATLAS",
   "title": "LLM Jacking",
   "published_at": "2025-04-22"
  },
  {
   "url": "https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack",
   "publisher": "sysdig.com",
   "title": "LLMjacking: Stolen Cloud Credentials Used in New AI Attack",
   "published_at": "2025-04-22"
  },
  {
   "url": "https://sysdig.com/blog/growing-dangers-of-llmjacking",
   "publisher": "sysdig.com",
   "title": "The Growing Dangers of LLMjacking: Evolving Tactics and Evading Sanctions",
   "published_at": "2025-04-22"
  },
  {
   "url": "https://sysdig.com/blog/llmjacking-targets-deepseek",
   "publisher": "sysdig.com",
   "title": "LLMjacking targets DeepSeek",
   "published_at": "2025-04-22"
  },
  {
   "url": "https://incidentdatabase.ai/cite/898",
   "publisher": "AI Incident Database",
   "title": "AIID Incident 898: Alleged LLMjacking Targets AI Cloud Services with Stolen Credentials",
   "published_at": "2025-04-22"
  }
 ],
 "source_count": 5,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "llm-jacking",
  "credential-theft",
  "reverse-proxy"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}