Wiz Details Stolen AI Credentials Abused for Millions of Bedrock Calls

Oct 30, 2026 · Original article ↗

Summary

Wiz analyzes nine AI developer-platform incidents and two enterprise keys it attributes to one vendor breach, documenting about 2.5 million Bedrock calls. It says resale operators accessed the keys, but their connection to the attacks or high-volume abuse is unproven.

Key points

At least nine AI developer platforms disclosed incidents during October; most were still under investigation, with detailed technical information limited.
Public reports described targeted searches for stored environment variables, including credentials granting AI access. Fireworks AI, Zeabur, and Lightning AI attributed their incidents to credential access.
Wiz says it linked the compromise of two enterprise credentials to one vendor breach. The first unauthorized activity on both keys occurred within 30 minutes of reported credential access and tested the keys from a residential IP.
One key generated approximately 800,000 Bedrock calls over 30 hours, about 90% successful. Its policy allowed global cross-region inference profiles, and only about 6% of calls were throttled.
A second key generated approximately 1.7 million Bedrock calls over 13 hours, with more than one million successful. Its regional policy limited routing, and most unsuccessful calls were throttled.
Wiz found matching quota-probing scripts and evidence that two LLM resale operations accessed the keys. It could not definitively link those operators to the initial compromise or the high-volume abuse.
Wiz estimates the two cases likely incurred more than $100,000 in usage at list price; this is an estimate, not a confirmed loss.

Article Details

Attack Vectors: Several AI developer platforms attributed incidents to credential access; public reports described targeted searches for stored environment variables, especially those granting AI access.
Stolen AI credentials were tested across organizations and used to enumerate Bedrock models, inference profiles, regional availability, and Bedrock and EC2 quotas.
Compromised keys were used for high-volume Bedrock API calls, with traffic routed through cross-region inference profiles where permitted.
The article reports that stolen keys were used by resale operations offering discounted access to AI models; it does not definitively link those operations to the initial platform compromises or the high-volume abuse.
Defensive Notes: In Case B, a key restricted to us.* cross-region inference profiles rejected calls requesting global.* profiles; regional quotas also limited the volume of successful calls.
The keys in both case studies were remediated after the reported periods of high-volume use.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`llm-routing[.]com`	Active LLM resale site hosted on infrastructure associated with “momo”; it advertised discounted access to frontier models and accepted USDT.
DOMAIN	`xingjiabiapi[.]org`	Resale site offering discounted access to frontier models; infrastructure tied to the site was used to check permissions on stolen keys.
HOSTNAME	`artex[.]nhhh[.]de`	Subdomain resolving to the IP Zeabur publicly identified as part of its compromise; it hosted a page titled “ARTEX — autonomous penetration testing console.”
HOSTNAME	`s3[.]xingjiabiapi[.]org`	Subdomain resolving to the Xingjiabi-linked IP; that infrastructure enumerated Bedrock profiles, models, and quotas using a stolen key.
IPV4	`104[.]243[.]32[.]50`	Listed as checking permissions on several stolen keys; the article suspects it is linked to LLM token abuse and resale.
IPV4	`23[.]106[.]46[.]239`	IP associated with the “momo” resale operation, credential checks on stolen keys, and infrastructure Zeabur publicly identified as part of its compromise; the article does not definitively link it to the high-volume abuse.
IPV4	`31[.]57[.]201[.]201`	Listed as using multiple stolen keys; the article suspects it is linked to LLM token abuse and resale.
IPV4	`38[.]246[.]114[.]118`	Infrastructure tied to the Xingjiabi resale operation that checked permissions on stolen keys and enumerated Bedrock profiles, models, and quotas.