“Black October” for AI Developer Platforms

A coordinated campaign dubbed 'Black October' targeted multiple AI developer platforms in October, resulting in at least nine disclosed security incidents. The attacks exploited credentials through various initial access vectors, including supply chain compromises, privilege escalation, and third-party dependencies. Threat actors focused on stealing AI model access keys to enable LLMJacking—monetizing stolen tokens via resale platforms. Wiz observed downstream abuse of compromised enterprise credentials, with attackers validating keys, probing model availability, and launching massive inference floods across services like AWS Bedrock, generating over $100k in estimated usage. Two resale hubs, linked to IPs 23.106.46.239 and 38.246.114.118, were identified as key players in the illicit LLM token economy.

AI-extracted · verify before operational use