Attackers who obtain AWS credentials are actively validating them to determine their usefulness for accessing Amazon Bedrock services. Credential harvesting platforms, including KMON_NOC, test stolen AWS keys by calling GetCallerIdentity, then verifying Bedrock access through ListFoundationModels and Converse API calls. This validation enables attackers to assess the value of credentials for resale in token-jacking markets, where stolen AI model access is sold below retail price. The testing targets Anthropic Claude models and enumerates promotional credits to estimate financial worth. This behavior represents an evolution in credential validation techniques similar to those previously observed with AWS SES and SNS services.
LAMEHUG, discovered on July 10, 2025, is the first known malware integrating large language model capabilities into its attack methodology. Attributed to APT28 (Fancy Bear) with moderate confidence, it targeted Ukrainian government officials through phishing emails containing malicious executables. The malware uses the LLM Qwen2.5-Coder-32B-Instruct via Hugging Face's API to generate dynamic attack commands. Multiple variants were identified, with different data exfiltration methods. The attack appears to be a proof-of-concept exploration of LLM integration in state-sponsored cyber operations, demonstrating sophisticated reconnaissance capabilities through AI-generated commands. This development signals a new era of AI-incorporated malware operations, posing challenges for traditional cybersecurity approaches.
Trojan horses, once rare, are making a resurgence due to AI and Large Language Models (LLMs). These new trojans, disguised as legitimate applications like recipe apps or AI-powered image search tools, are evading traditional security measures. They appear professional, pass VirusTotal scans, and exploit users' trust. Examples include JustAskJacky, which executes hidden commands, and TamperedChef, which hides malicious code in recipe whitespace. LLMs enable threat actors to create convincing websites and functional applications easily, making trojans indistinguishable from legitimate software. This trend challenges conventional user caution and static antivirus scanning, necessitating advanced security measures like context, behavior, and dynamic analysis for detection.
