LLMjacking via Laravel exploitation (Incident)

Threat actors exploited a vulnerable, publicly exposed Laravel instance (CVE-2021-3129) to steal cloud credentials, enumerate permissions across AWS/Azure/GCP, and attempt unauthorized access to LLM services (notably Anthropic Claude). They used an open-source reverse proxy (OAI Reverse Proxy) to operate multiple compromised accounts and validated access via the InvokeModel API, apparently to monetize access while minimizing detection.