New process bursting calls to AI inference APIs (LLMjacking via stolen keys)

ills3c Intel&Coffee@Ills3C

•updated today•0•0•3

Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.