LLMjacking: Stolen Cloud Credentials Turn Into a Reverse Proxy for Stolen LLM Access
Attackers exploited an unauthenticated RCE in Ignition (Laravel's debug-mode package, CVE-2021-3129) to harvest cloud credentials, then validated those credentials against ten AI services -- including a local Claude v2/v3 deployment on AWS Bedrock -- and resold access through an "OAI Reverse Proxy," checking Bedrock's invocation-logging configuration before use to gauge detection risk. Sysdig's original research puts realistic victim exposure at over $46,000/day; a commonly repeated $100,000/day figure belongs to a different, unrelated LLMjacking case.
CVE-ID: CVE-2021-3129
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerable component: Ignition (Laravel’s debug/error-page package), before 2.5.2
Fix available: Yes — Ignition 2.5.2+
What happened
Attackers exploited an unauthenticated remote-code-execution flaw in
Ignition — the debug-mode error page shipped with Laravel — to compromise a
site running Laravel with debug mode enabled. The RCE itself is old news:
Ignition’s insecure use of file_get_contents()/file_put_contents() has
been public since January 2021. What made this campaign notable is what the
attackers did after getting in: rather than the usual web-shell-and-pivot
playbook, they harvested cloud credentials from the compromised host and
used them to probe access to ten different AI services — including a local
Claude v2/v3 deployment on AWS Bedrock, Azure, GCP Vertex AI, and several
others.
Once they confirmed working credentials, the attackers stood up an “OAI
Reverse Proxy” to resell access to the stolen LLM capacity — effectively
turning someone else’s cloud bill into a monetizable API-key-as-a-service
operation. They also made deliberate calls to Bedrock’s
GetModelInvocationLoggingConfiguration API before using the stolen access,
checking whether their activity would be logged and adjusting accordingly.
Security researchers have since coined a name for this pattern —
LLMjacking — and it has recurred with other leaked-credential vectors
since.
Correcting the record
The incident as it’s circulated in some secondary write-ups cites victim
costs of up to “$100,000 per day.” That figure doesn’t hold up against the
primary research: Sysdig’s original disclosure puts the realistic exposure
at over $46,000 per day, based on Bedrock’s per-token pricing for Claude
2 at maximum quota across regions. (A $100k/day figure does exist in
LLMjacking reporting, but it traces to a different incident — one
involving a leaked long-lived AWS IAM key with AdministratorAccess, not
this Laravel/Ignition case.) It’s a useful reminder that “LLMjacking” isn’t
one incident, it’s a pattern, and cost figures from one case shouldn’t be
copy-pasted onto another.
Why it matters
This isn’t really a story about Ignition, or even about Laravel — that vulnerability has a four-year-old patch. It’s a story about what stolen cloud credentials are worth once generative AI services are sitting behind them. A credential leak that used to mean “attacker can read your S3 buckets” now also means “attacker can resell your model access to third parties,” with the added twist that the attacker actively checks whether their usage will be logged before running up your bill. Credential hygiene and IAM scoping were already load-bearing controls; AI service billing just raised the stakes on getting them wrong.
Validation status
Tier: corroborated. This write-up is based on the primary Sysdig disclosure, one independent secondary source, one corroborating vendor catalog entry, and the authoritative NVD/CVE record for the underlying vulnerability. Nothing in this incident was independently reproduced — no exploitation, credential harvesting, or proxy setup was executed by us. The technical narrative above reflects what the cited sources report, not firsthand verification.