Source: news – ZDNET
Threat actors are systematically harvesting API keys and cloud credentials to run expensive LLM queries on stolen enterprise accounts, with victims discovering $100K+ monthly bills retroactively. The attack exploits the pay-per-token model of modern AI services, creating a new attack surface that most companies lack visibility into until the damage appears on their next cloud bill. The underground credential trade has made this lucrative enough to industrialize, forcing enterprises to treat API key hygiene as a financial security issue.