Overview
This week’s security roundup from SecurityWeek surfaces two AI-specific threats with real financial and operational consequences. First, LLMjacking — the practice of stealing cloud-hosted LLM API credentials to run inference at the victim’s expense — has now crossed the $1 million threshold in accumulated fraudulent billing. Second, a documented phishing campaign is using fake event registration pages impersonating OpenAI, SpaceX, and Anthropic to harvest corporate Microsoft and Google credentials from marketing employees.
On the defensive side, Anthropic has introduced a suite of enterprise security controls for Claude, including inference hooks that allow organisations to inspect prompts and tool calls through existing DLP pipelines before they reach the model.
Technical Analysis
LLMjacking at scale: Threat actors obtain valid API keys — typically through credential stuffing, misconfigured repositories, or phishing — and then use them to run high-volume inference workloads. Because LLM API costs are metered, victims face enormous unexpected charges before detecting the abuse. The $1M figure represents cumulative billing across affected organisations, illustrating how rapidly stolen credentials can be monetised without directly exfiltrating data.
AI-brand phishing campaign: Push Security documented a campaign using fake registration pages for OpenAI, SpaceX, and Anthropic events, baiting targets with incentives such as three months of ChatGPT Pro or Grok Heavy access. The Microsoft login path triggers a device code authentication flow delivered via the Kali365 phishing-as-a-service platform, which captures tokens without requiring the attacker to intercept a password directly. The campaign uses Google and Zapier short links, Cloudflare challenges for evasion, and rotates domains every few weeks. Push links the operator with medium-high confidence to earlier fake Zoom event phishing infrastructure.
Framework Mapping
- AML.T0040 (AI Model Inference API Access): LLMjacking directly abuses inference APIs using stolen credentials to consume compute at victim expense.
- AML.T0012 (Valid Accounts): Both attack chains rely on obtaining and abusing legitimate credentials — API keys in LLMjacking, OAuth tokens in the phishing campaign.
- AML.T0113 (Steal Web Session Cookie) / AML.T0114 (AI Service Web Interface): The device code phishing flow targets AI service authentication specifically, harvesting tokens that grant access to work accounts.
- LLM06 (Sensitive Information Disclosure): Stolen API access could expose prompts, outputs, and organisational data processed through the LLM.
- LLM04 (Model Denial of Service): Sustained API abuse from LLMjacking degrades service availability and imposes financial denial-of-service on victims.
Impact Assessment
Organisations with exposed LLM API credentials face direct financial harm through unexpected inference billing, potentially reaching hundreds of thousands of dollars before detection. Marketing teams — specifically those likely to register for professional events — are the primary target demographic for the phishing campaign. Successful device code phishing yields persistent OAuth tokens that can bypass MFA and enable lateral movement within Microsoft 365 or Google Workspace environments well beyond the initial AI service account.
Mitigation & Recommendations
- Rotate and scope LLM API keys — apply least-privilege scopes, set billing alerts, and store credentials in secrets managers rather than code repositories.
- Disable device code flow at the identity provider level for all users who do not require it, or restrict it to managed devices.
- Deploy Anthropic Claude Enterprise inference hooks to run prompts through DLP inspection before model execution.
- Train marketing and event-registration-heavy teams to verify event invitations through official brand channels before entering work credentials.
- Monitor for anomalous LLM API spend using cloud cost anomaly detection with low thresholds tuned to baseline usage.