LLM Hijackers Quickly Incorporate DeepSeek API Keys

Researchers observed widespread "LLMjacking" operations in which attackers obtain stolen API keys and cloud credentials to proxy access to commercial LLMs (e.g., DeepSeek), deploy OAI reverse proxies (ORPs) with obfuscation and Cloudflare tunnels, and spread usage across many accounts to evade detection; incidents have caused significant unexpected billing (examples include personal AWS accounts incurring $10k–$20k in hours) and rapid abuse of newly released models shortly after their launch.