Defensive Dispatch

Author: Tony Schliesser

  • Cloud platform may have exposed stored credentials: why you should rotate secrets and check AI bills

    BLUF: Bottom Line Up Front

    Northflank, a cloud hosting platform, told customers to replace all stored secrets after reports that AI API keys were misused. The cause is unconfirmed, but exposed keys can let outsiders run up paid AI usage on your account. If you use Northflank, rotate credentials now and review AI billing.

    Key Points

    • Northflank is investigating reported unauthorized use of AI keys and has told customers to treat stored environment variables, which often hold passwords and API keys, as compromised.
    • The entry point, the attacker, and the affected customers are not yet confirmed, so the rotation advice is precautionary, though Northflank linked the activity to a wider October pattern of attacks on AI platforms described by Wiz.
    • Organizations running workloads on Northflank face possible fraudulent AI charges (called LLMjacking) and wider exposure of database and application credentials held in workloads, secret groups, and global settings.
    • Revoke existing credentials with the providers that issued them, create replacements, and update the affected Northflank secrets and workloads, rather than rotating only keys already showing abuse.
    • Ask your IT team to review AI provider usage and billing for unexpected activity, report anything suspicious to Northflank and the provider, and restrict public access to add-ons.

    Read more: Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets

  • Cloud LLM Access Hijacking and Underground Resale by Financially Motivated Actors

    BLUF: Bottom Line Up Front

    Mandiant and GTIG report 2026 incidents in which attackers hijacked enterprise LLM access, mainly through stolen cloud identity tokens and exposed API keys, running up fraudulent charges of $100,000+ in a day and up to $1 million. Stolen access is resold through "LLM Mixers." Defenders should lock down credentials, alert on LLM service enablement, enable relevant audit logs, and patch gateways such as LiteLLM.

    Key Points

    • Exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub PATs, session tokens) were the dominant initial access vector, though exposed LLM endpoints and leaked LLM API keys were also targeted.
    • Attackers validated stolen keys with single-token requests (max_tokens=1) to avoid volume-based alerts, so defenders should watch gateway and API logs for low-volume validation pings.
    • For persistence and escalation, actors created unauthorized IAM and service accounts, injected SSH keys into compute instances, and abused token-creation privileges, while a LiteLLM flaw (CVE-2026-40217) let Virtual Keys become PROXY_ADMIN credentials.
    • LLM Mixers such as jet-night.com and the newapi[.]pro ecosystem pool stolen keys and resell cheap access, shifting costs to victims, with UNC6993 using tools like new-api and gcli2api.
    • Defenders should treat unauthorized enablement of LLM services as critical, turn on data-plane audit logging in AWS, Azure, and GCP, and enforce least privilege, secret scanning, phishing-resistant MFA, quotas, and spending caps.

    Read more: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources | Google Cloud Blog