Cloud credential theft has found a new monetization channel. Security researchers at Permiso discovered underground operators selling stolen access to Claude, GPT-4, and Gemini APIs for as little as $60 per month. The legitimate account holders, meanwhile, face monthly bills that can exceed $46,000.
How the underground market works
Attackers harvest cloud provider credentials through phishing, exposed .env files, or compromised CI/CD pipelines. Once they have an AWS or GCP key with LLM API access, they do not burn the credentials with direct use. Instead, they onboard subscribers, run a reverse-proxy layer in front of the stolen endpoint, and charge monthly fees. The stolen account absorbs the actual API costs.
The economics are brutal for victims: each subscriber the attacker adds increases the legitimate account's bill while the attacker pockets the margin. At $60 per subscriber, an attacker running 100 clients generates $6,000 per month profit from a single compromised key.
What the alert looks like from inside a breached account
The first signal is usually a billing alert or quota exhaustion, not a security alert. API usage spikes at off-hours, often in geographic regions the organization does not operate in. Model selection also shifts: attackers route subscribers to the cheapest models that satisfy their use case, so sudden model-switching patterns can indicate unauthorized sharing.
Detection priorities
If you manage cloud workloads with LLM API access, three controls matter most:
- Rotate API keys on a 90-day or shorter cycle, and treat any key with billing exposure as a privileged credential
- Set hard spend caps and anomaly alerts on AI service billing, separate from overall cloud budget alerts
- Review IAM policies quarterly: LLM API permissions should follow least-privilege the same as compute permissions
The durable lesson
Stolen credentials have always been monetizable. What LLMjacking adds is a subscription wrapper: attackers can now sell persistent access rather than dumping credentials on a market once. This extends the window of harm per compromised key and makes early detection through billing signals more important than perimeter controls.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team needs help auditing cloud credential exposure or LLM API access controls.