Category: Cloud Security, Hacking, Identity and Access Management

LLMjacking: How attackers use stolen AWS credentials to enable LLMs and rack up costs for victims

The most common API actions called by attackers via compromised credentials earlier this year included InvokeModel, InvokeModelStream, Converse, and ConverseStream. However, attackers were also recently observed using PutFoundationModelEntitlement and PutUseCaseForModelAccess,