LLMjacking Evolved: Operation Bizarre Bazaar and Stolen AI Compute as Offensive Infrastructure

Executive Summary

The threat landscape for self-hosted AI infrastructure has undergone a fundamental shift in 2026. What began as opportunistic compute theft — hijacking exposed LLM inference endpoints to resell API access at discounted rates — has matured into two convergent threats: (1) industrialized commercial supply chains that systematically scan, validate, and monetize stolen inference across thousands of victims per day; and (2) autonomous offensive tooling where the same stolen compute powers multi-stage exploitation pipelines with no human intervention between scanning, vulnerability matching, exploit generation, and compromise.

The scale is staggering: approximately 175,000 exposed Ollama instances alone span 130+ countries as of January 2026, with credential theft targeting AI services rising 376% quarter-over-quarter. By June 2026, the VAPT pipeline incident demonstrated that stolen inference can function as a cognitive engine for fully automated penetration testing — closing the loop between LLMjacking and agentic offensive AI into a single operational attack chain.

Overall Confidence: Medium-High. All primary claims are sourced to vendor research publications (SentinelOne/Censys, Sysdig TRT, Pillar Security, CSA Labs). Attribution details carry lower confidence due to reliance on infrastructure correlation rather than direct evidence.

1. The Evolution Arc: Compute Theft → Autonomous Weaponization

Phase 1 — Opportunistic API Scraping (2024–mid-2025)

The earliest form of LLMjacking involved harvesting leaked or hardcoded API keys from public repositories, misconfigured cloud deployments, and weak service authentication. Attackers used stolen keys directly to access commercial models (OpenAI GPT-4, Anthropic Claude) for their own research, content generation, or resale — without building any infrastructure around the theft.

Key characteristics:

• Single actor per incident
• Manual discovery (GitHub repos, pastebin dumps)
• Direct consumption of stolen API credits
• No monetization layer beyond personal use or small-scale resale on forums

Phase 2 — Industrialized Resale Marketplace (Q4 2025 – Q1 2026)

Operation Bizarre Bazaar documented the first systematic commercial LLMjacking supply chain. Three interconnected actor roles formed a complete pipeline:

• Scanner: Distributed bot infrastructure systematically probes Shodan/Censys for exposed AI endpoints, triggering exploitation within hours of public listing.
• Validator: Dedicated infrastructure tests discovered endpoints with placeholder API keys (sk-test, test-token, dev-key) and enumerates model capabilities.
• Marketplace Operator: Runs silver.inc ("The Unified LLM API Gateway"), a bulletproof-hosted commercial marketplace reselling access to 30+ LLM providers at 40–60% discounts via Discord/Telegram channels with crypto and PayPal payments.

Scale (Operation Bizarre Bazaar, Jan–Feb 2026):

• 35,000+ attack sessions over 40 days (~972/day)
• MCP reconnaissance comprised 60% of late-January traffic
• Daily victim costs exceeding $100,000 when Claude Opus-tier models are targeted

Attribution: "Hecker" (aliases: Sakuya, LiveGamer101), self-identified on admin panel at admin.silver.inc. Infrastructure shares Cloudflare nameservers and DMARC records with nexeonai.com. Bulletproof hosting in the Netherlands. Attribution confidence based on infrastructure correlation only — no state-actor linkage established.

Confidence: Medium. Infrastructure overlap is consistent but not conclusive for attribution beyond a single operator or small group.

Phase 3 — Autonomous Offensive Tooling (June 2026)

The Sysdig TRT VAPT pipeline incident represents a qualitative break from prior LLMjacking patterns. The actor did not simply resell stolen compute — they wired an exposed Ollama server into a multi-stage autonomous exploitation framework:

1. Service fingerprinting via nmap banner normalization → CPE identification
2. Vulnerability matching against CVE databases for specific software versions
3. Web reconnaissance of observation bundles (headers, cookies, form fields)
4. Proof-of-concept synthesis with protocol-aware payloads
5. Blind SQLi crafting with timing-based filter evasion
6. Credential and secret extraction (most-invoked stage — run 100+ times)
7. Arbitrary file-read planning for credential harvesting
8. Privilege escalation decision-making based on host environment
9. Autonomous orchestration driving the entire chain to command execution

The actor iterated on this framework over ~14.5 hours across two days (June 12–14, 2026), growing from a minimal stage set to a complete nine-stage pipeline that ran against private benchmark ranges (HackTheBox lab spaces). The tool referenced commercial models (`gpt-4o-mini`, `claude-3-5-sonnet`, `gemini-2.0-flash-exp`) via Ollama — confirming backend substitution of paid inference with stolen compute.

This is the operational convergence point: LLMjacking ceased to be purely an economic crime and became a vector for autonomous offense. The cost of running agentic offensive tooling collapsed toward zero.

Confidence: High for the VAPT pipeline architecture (captured directly from API traffic). Medium-Low for actor motivation — could represent legitimate pentest testing, though illegal regardless.

2. Scale of the Threat Environment

Exposed Inference Infrastructure at Internet Scale

The exposure problem is structural: These services are rarely "hacked" in the traditional sense. Most operators simply set `OLLAMA_HOST=0.0.0.0` and forgot to add a firewall rule. Containerized deployments default to binding on all interfaces, and port-forwarding via NAT adds another layer of accidental exposure that most homelabbers don't audit.

Credential Theft Growth Against AI Services

CVE Impact on the Ecosystem

3. Supply Chain Weaponization: From Resale to Offense

The June 2026 VAPT pipeline incident closed a loop between two previously separate threat trends:

LLMjacking (coined May 2024 by Sysdig): Theft of paid model access for resale. Evolved from ad hoc API key scraping to industrialized black market with Operation Bizarre Bazaar — first fully documented, attributed campaign complete with commercial marketplace monetization.

Agentic Offensive AI (research since 2024): AI agents that chain vulnerability advisories into working exploits. Published research shows capable models can autonomously exploit 87% of one-day vulnerabilities; agent teams have demonstrated the ability to attack zero-day vulnerabilities.

The VAPT operator merged both vectors. Stolen inference became not just a commodity to resell but the cognitive core of an automated offensive pipeline — scanning, triaging, exploiting, and pivoting with no human decision-making between stages. The tool's nine-stage architecture demonstrates that the barrier to running autonomous offense has collapsed: any actor with access to exposed compute (ubiquitous in 2026) can build and iterate on such a framework without paying for commercial API credits or maintaining their own GPU infrastructure.

This convergence also means the same scanner infrastructure that targets Ollama endpoints for resale (Operation Bizarre Bazaar's Scanner role) is operating in the same address space as actors building VAPT-style autonomous exploitation pipelines — they just happen to be at different stages of capability development and operational readiness.

4. MITRE ATT&CK Mapping

LLMjacking Campaigns (Operation Bizarre Bazaar, MCP Reconnaissance)

OWASP Top Risks Exploited Against AI Services

5. Detection Methodology

High-Signal Indicators (VAPT Pipeline — Specific to June 2026 Incident)

Medium-Signal Indicators (Contextual)

Detection Checklist for Homelab Operators (Summary)

1. Discovery: Run ss -tlnp | grep :11434 — confirm loopback binding (127.0.0.1), not all-interfaces
2. Internet exposure check: From a cellular device, attempt curl --connect-timeout 5 http://<public_ip>:11434/api/version — any response over non-loopback = exposure
3. Docker audit: docker ps --format "{{.Names}}: {{.Ports}}" | grep 11434 — confirm 127.0.0.1: prefix on port bindings, not bare or 0.0.0.0:
4. Firewall enforcement: sudo ufw deny 11434/tcp — defense-in-depth catch for configuration drift
5. Router NAT table audit: Remove any forwarding rules pointing at inference ports (11434, 7860, 8080, 8000, 5000, 3000)
6. Weekly automated scan: Cron job checking all listening AI service ports and their bind addresses

6. Defense Checklist (Actionable, Operator-Focused)

Immediate Actions (0–24 Hours)

• [ ] Set OLLAMA_HOST=127.0.0.1:11434 — single most important step for Ollama
• [ ] Run sudo ufw deny 11434/tcp as defense-in-depth catch
• [ ] Verify Docker port bindings use 127.0.0.1: prefix for all AI service containers
• [ ] Check router admin UI — remove any NAT/port-forwarding rules pointing at inference ports
• [ ] Update Ollama to v0.17.1+ (patches CVE-2026-7482 "Bleeding Llama", CVSS 9.1)

Short-Term Actions (1–7 Days)

• [ ] Audit all docker-compose files for non-loopback port mappings (pattern: ["PORT:PORT"] without IP prefix)
• [ ] Disable DMZ mode if entire homelab is exposed regardless of local firewall rules
• [ ] Replace default bridge Docker networks with custom isolated networks for AI services
• [ ] If remote access required, deploy Tailscale/WireGuard instead of exposing ports publicly

Long-Term Improvements (1–30 Days)

• [ ] Implement reverse proxy (nginx/Caddy) with authentication in front of any publicly-accessible service
• [ ] Deploy dedicated VLAN for AI inference services with restricted outbound rules
• [ ] Run quarterly exposure audits using purpose-built tools: AIMap (Bishop Fox), OllamaHound, ai_osint (7WaySecurity)
• [ ] Rotate all API keys/secrets if any instance was ever exposed on 0.0.0.0 without authentication — assume memory contents were readable by attackers

Authentication Architecture for Self-Hosted AI Services

7. Operational Status and Monitoring Recommendations

Current State (as of July 2026)

• silver.inc continues to operate — the Bizarre Bazaar supply chain has not been dismantled
• CVE-2026-7482 patched but adoption unclear — Ollama v0.17.1+ available but unknown percentage of exposed instances have updated
• Langflow CVEs actively exploited in production (VulnCheck Canaries, June 9, 2026) by the same actor pool targeting Ollama
• MCP reconnaissance at 60% of late-January traffic (Operation Bizarre Bazaar era) — may or may not be connected to silver.inc operation; remains a distinct threat vector

What Defenders Should Monitor

1. Compute anomalies on inference servers — hundreds of sequential model calls over hours is characteristic of automated tooling, not normal usage
2. Commercial model names appearing in Ollama API traffic (`gpt-4o-mini`, `claude-3-5-sonnet`) from a server that should only serve local models
3. Structured-output request patterns — strict JSON schemas with no conversational prompts indicate code consuming responses, not human chat
4. Marker-bracketed command probes in response data (e.g., `VAPTb3gin`/`VAPTfin`) — the begin-end RCE confirmation pattern is unique to automated pipeline tooling

8. Confidence Assessment

Overall Confidence: Medium-High

Key Uncertainties

1. Full actor identity — "Hecker" attribution is infrastructure correlation only; organizational affiliation (individual vs. group vs. state-sponsored) unconfirmed
2. MCP campaign linkage to silver.inc — reports note uncertainty about whether the 60% MCP reconnaissance traffic is connected to Bizarre Bazaar
3. Real-world victim impact beyond honeypot data — published reports focus on honeypot observations; actual victim count, financial damage, and exfiltrated data are not quantified in public sources
4. Current operational status of silver.inc — original publication was January/February 2026; the marketplace may have changed infrastructure, rebranded, or been taken down since

Sources

Synthesis compiled from four parent research reports (VAPT pipeline incident, Operation Bizarre Bazaar, LLMjacking statistics, detection/defense methodology). All primary figures verified against original vendor publications. No fabricated indicators or unverifiable claims included.