Stories
Hackers Steal AI Access to Fuel New Cybercrime Wave
- •Hackers are increasingly stealing access to AI accounts and computing infrastructure, a practice known as "LLM-jacking," to use powerful models without paying the substantial costs.
- •Google Threat Intelligence Group reports a sharp rise in these attacks, ranging from stealing login credentials for AI services to breaking into corporate servers for computing capacity.
- •A black market has emerged on the dark web, selling unauthorized access to advanced AI models from OpenAI, Anthropic, and Google at discounts of up to 97%.
- •Attackers are also targeting companies' cloud servers to install their own AI models, leveraging stolen computing resources, similar to cryptojacking.
- •AI tools are being integrated into cybercrime operations, automating tasks and accelerating analysis, making AI infrastructure protection as crucial as securing the models themselves.
Key Questions Answered
LLM-jacking is an emerging underground business where hackers steal AI account credentials or breach corporate cloud servers to use powerful models and expensive computing capacity without paying the legitimate costs. Attackers use these stolen resources to operate at a financial advantage for cybercrime, espionage, and other malicious activities.
Google researchers have identified dark web marketplaces selling unauthorized access to advanced models from companies like OpenAI, Anthropic, and Google at discounts of up to 97 per cent. Some sellers even offer replacement credentials if the original accounts are blocked by AI companies monitoring for suspicious activity.
Businesses are rapidly adopting artificial intelligence and are still working out how much computing capacity their systems require, meaning sudden increases in server usage may not immediately look suspicious. This allows attackers to hide their malicious activity among legitimate increases in AI workloads.
