LLMjacking 2026: Attackers Drain $100K Daily From Stolen AI Accounts, 175K Ollama Servers Exposed

LLMjacking AI compute theft exploits the gap between how organizations secure traditional credentials and how they treat AI API keys. Most enterprises apply strict controls to cloud access keys and database passwords while treating LLM API keys as low-value configuration values, storing them in plaintext in code repositories, CI/CD environment variables, or local .env files.

Attackers run constant automated scans across GitHub, GitLab, npm packages, PyPI distributions, and Docker Hub image layers using tools like trufflehog and gitleaks. When a key is discovered, a validation script tests it against the provider's API within seconds. Valid keys are immediately routed to one of two outcomes: direct high-volume inference that generates bills for the victim, or resale through a proxy marketplace.

The proxy marketplaces operate as commercial platforms. They accept payment via WeChat, Alipay, or cryptocurrency, route customer requests through the stolen credentials, and return model responses as if the customer had legitimate access. What the customer typically does not know: the proxy logs every prompt, every response, and every reasoning chain. Those traces are sold downstream to AI labs engaged in model distillation -- the process of training a smaller model to mimic a larger one using its outputs. One Claude 3 Opus account could generate over $100,000 per day in inference costs if exploited at full capacity, according to LLMjacking research by hard2bit.

Exposed Ollama servers represent a zero-effort variant of the same attack. Ollama, the popular tool for running open-weight models locally, binds to all interfaces by default and provides no authentication layer. An attacker who finds an exposed instance on port 11434 can invoke any model installed on the server, consume the victim's compute and electricity, and use it as a stepping stone for further network attacks. Security researchers have identified automated frameworks that use compromised Ollama servers to fingerprint enterprise networks and match discovered services to known vulnerabilities.

Operation Bizarre Bazaar, a threat intelligence analysis covering December 2025 to January 2026, documented 35,000 distinct attack sessions targeting AI provider accounts across 30-plus platforms. The operation ran automated scanning infrastructure, credential validation pipelines, and a commercial resale marketplace that attackers accessed like a subscription service.

Individual premium accounts became extremely valuable targets. A single account with access to frontier models generated daily billing charges exceeding $100,000, according to Operation Bizarre Bazaar research. Attackers prioritized accounts with high rate limits and access to the largest context windows, as those configurations enabled the most profitable resale operations.

The Alibaba distillation campaign, running from April 22 to June 5, 2026, demonstrated a parallel and more strategic objective. Researchers documented approximately 25,000 fraudulent accounts making 28.8 million exchanges with Claude during this period. The operation was not primarily focused on compute resale. Its goal was systematic prompt-and-response data collection to train competing models -- the largest known model distillation attack on Anthropic, according to researchers at ExplainX who analyzed the campaign.

The financial and strategic harms compound each other. Victims face unexpected five-figure billing charges. Their proprietary workflows, internal prompts, and sensitive data submitted through those sessions are captured and potentially used to train competitive AI systems. Organizations using AI for product development, legal review, or financial analysis are at particular risk of proprietary information leakage through this channel. For the growing category of AI-native SaaS companies proxying AI requests on behalf of customers, a single compromised API key that routes customer traffic threatens both the company's finances and its customers' data confidentiality. The attack pattern from AgentForger enterprise AI agent attacks shows how AI infrastructure has become a primary enterprise attack surface in 2026.

The AI token black market operates through four layers. At the top, fraudulent accounts are created at scale using stolen payment methods, synthetic identity documents, and in some cases face video harvested from compromised devices -- the account creation fraud Anthropic began countering in July 2026 with a government ID plus biometric verification rollout at Pro/Max checkout.

Below that, proxy gateway tools aggregate multiple stolen accounts and present them as a single API endpoint. Resellers purchase access to these gateways and build their own storefronts offering AI access at 70 to 90 percent discounts from official pricing. Documented resellers have offered Claude tokens at 93 percent off and Codex access at 1 to 5 percent of official rates, driven by regional promotional credit harvesting at near-zero cost.

At the consumer level, developers who are price-sensitive or in markets with restricted access to frontier models purchase through these channels without always knowing the source. The reseller's gateway routes requests through stolen accounts, logs every exchange, and returns responses seamlessly. A Shanghai developer pointed at a proxy URL and paying via WeChat is effectively routing their work through stolen credentials while the proxy logs every prompt and bills a compromised account opened with a face video harvested in Lagos, per researchers documenting the supply chain.

The intelligence gathered through this process -- detailed prompts, internal workflow descriptions, sensitive data, and model reasoning chains -- is sold to competing AI labs. The resulting distillation attacks compress the capability of frontier models into smaller, cheaper systems. This is not theoretical: the Alibaba campaign in 2026 demonstrates active, systematic execution of this strategy at scale. Organizations using AI for competitive advantage should treat prompt confidentiality as a security requirement, not just a business preference.

The primary IOC category for LLMjacking is proxy domains -- domains used to route stolen AI compute to paying customers. Block these at your web gateway and corporate DNS to prevent employees from inadvertently routing work through compromised infrastructure.

The most reliable detection signals are behavioral rather than signature-based: sudden billing spikes, high-volume inference at unusual hours, requests from IP ranges inconsistent with your developer geography, and model invocations from processes or applications that should not be making AI API calls. Configure your AI provider's billing alert to fire at hourly thresholds, not monthly aggregates -- by the time a monthly alert fires, a compromised key can have already generated $100,000 in charges.

The PromptSpy generative AI malware campaign demonstrates how AI-targeted malware has evolved to harvest credentials from mobile devices as a secondary infection objective, expanding the AI credential theft attack surface beyond traditional cloud environments.

No CVE-specific Sigma rule exists for LLMjacking because it is not a single vulnerability -- it is an attack class involving credential theft, account abuse, and network exposure. The two rules below detect the credential scanning phase: when an attacker has gained initial access to a developer workstation or CI/CD environment and runs automated secret scanners (trufflehog, gitleaks) to find AI API keys stored in code repositories, environment files, or git history.

Both rules require Sysmon process creation logging on Windows (Event ID 1) or equivalent process telemetry on Linux. Deploy in detection mode first -- legitimate DevSecOps pipelines sometimes run gitleaks or trufflehog as part of pre-commit hooks or CI/CD security checks, so baseline your environment before alerting on all matches. The WAF rules below address the Ollama exposure vector at the network perimeter, blocking unauthenticated access to the inference API from outside trusted IP ranges.

Stop LLMjacking AI compute theft with these seven controls, in priority order. Steps 1 through 3 are same-day actions that close the most direct exposure paths.

LLMjacking AI compute theft is not an emerging risk -- Operation Bizarre Bazaar ran a 35,000-session commercial marketplace while organizations treated AI API keys as low-value configuration tokens. The 376 percent rise in AI-targeted credential theft in Q1 2026 tracks the adoption curve directly: as more organizations integrate AI into critical workflows, the value of AI credentials rises in proportion.

The billing exposure is the most visible harm but not the most serious one. An organization that uses AI for legal document review, product design, or competitive analysis and routes that work through a compromised account or a downstream provider using stolen access has exposed its internal strategy and proprietary workflows to whoever operates the proxy. The Alibaba distillation campaign's 28.8 million logged Claude exchanges represent an intelligence harvest that has economic value independent of the compute cost imposed on victims.

The 175,000 exposed Ollama instances represent an underappreciated attack surface. Open-weight models running on developer workstations, lab servers, and cloud instances are the AI infrastructure equivalent of public-facing development databases: convenient to deploy, easy to forget to secure, and immediately accessible to anyone running a port scan. Security researchers have documented automated frameworks using compromised Ollama servers as reconnaissance platforms, fingerprinting enterprise internal networks through the victim's own inference hardware.

Organizations that have adopted AI at scale should treat this the same way they treat cloud IAM exposure: a continuous inventory problem, not a one-time remediation project. Every new AI key issued without controls and every new inference server deployed without authentication expands the attack surface. The controls in this post close the most common attack paths active today. Rotate your keys. Close port 11434. Set hourly billing alerts. Run gitleaks today.