04/27/2026
35,000 attacks. The first documented large-scale LLMjacking campaign — Operation Bizarre Bazaar — ran from December 2025 through January 2026 before Pillar Security caught it.
Here's what it looked like on the defender's side: Compromised cloud credentials → spun up to consume AWS Bedrock and Azure OpenAI quota → resold as discounted inference capacity through a commercial marketplace. The victims mostly found out from billing.
The economics are worse than typical cloud-credential abuse. Sysdig's research puts the per-victim daily cost at $46,000 for older models — and over $100,000/day for newer ones like Claude 3 Opus, because inference workloads hit GPU instances that don't stop burning money until you revoke the key.
Why this is a different threat category than legacy cloud-credential theft:
1. The attackers don't need root. They need an API key — or an unauthenticated endpoint.
2. They don't need persistence. Every key is a fresh product they can resell.
3. Detection via anomalous spend lags the attack by days. By then the key is already listed on the marketplace.
If your external attack surface includes hardcoded API keys in JavaScript bundles, exposed .env files, or committed-and-then-rotated GitHub tokens — you are pre-exposed to this threat category. (And if you think hardcoded secrets is a solved problem: GitGuardian found 1.27 million leaked AI-service secrets in 2025 alone — an 81% surge year over year.)
TRaViS scans externally for all of the above. Which of your apps is leaking an active inference API key? We can help you find out.
Sources: Pillar Security, "Operation Bizarre Bazaar" (2026). Sysdig Threat Research, "LLMjacking" (2024). GitGuardian, State of Secrets Sprawl 2026.
