Op Bizarre Bazaar: New LLMjacking Campaign Targets Unprotected Models
ID: 5991c0d1-a951-5fb8-bf3d-da02f81e2638
STIX ID: report--5991c0d1-a951-5fb8-bf3d-da02f81e2638
Feed Name: HackRead
Threat Score
Operation Bizarre Bazaar (Dec 2025–Jan 2026) is a large-scale LLMjacking campaign in which a criminal operator (aliases Hecker / Sakuya / LiveGamer101) scanned for and exploited unsecured LLM endpoints—especially open Model Context Protocol (MCP) configurations—stole compute and access, and resold access via a marketplace (silver.inc) at discounted rates; researchers observed ~35,000 attack sessions and advise enabling authentication on LLM endpoints and blocking the 204.76.203.0/24 range.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.