Operation Bizarre Bazaar: First Attributed LLMjacking Campaign with Commercial Marketplace Monetization

**Executive Summary:** Pillar Security uncovered Operation Bizarre Bazaar, a large-scale criminal campaign (LLMjacking) that probed and exploited exposed LLM and MCP endpoints—capturing 35,000 attack sessions—then validated compromised endpoints and resold access via the silver.inc marketplace; the report includes attribution to an actor known as "Hecker", observed TTPs (scanning, validation, data exfiltration, lateral movement), and prioritized mitigation recommendations including authentication, firewalling MCP servers, blocking known infrastructure, and rate limiting.