Hackers Exploit AI Infrastructure to Steal API Keys, Gain Persistence and Mine Cryptocurrency

Hackers are increasingly turning AI platforms into a doorway to valuable corporate systems. New Microsoft research shows that exposed AI gateways, retrieval tools, and workflow services can give intruders a path to provider credentials, databases, container environments, and powerful computing resources.

The activity spans three different targets: LiteLLM, RAGFlow, and Kestra. Although the entry points differed, the attackers followed a familiar money-making playbook: steal secrets, retain access, and use compromised servers for cryptocurrency mining or other downstream abuse.

These services now act as high-value control points. The findings also underline a shift in attacker interest.

Microsoft said in a report shared with Cyber Security News (CSN) that rather than going after only end users or conventional cloud servers, criminals are probing the infrastructure that connects applications to large language models, databases, and automation.

For security teams, unexplained spikes in AI consumption deserve the same urgency as the sudden bills seen in AI token jacking incidents.

Hackers Exploit AI Infrastructure

In the LiteLLM case, Microsoft assessed with high confidence that attackers likely exploited an exposed gateway through a chain involving CVE-2026-42271 and CVE-2026-48710.

The first payload read the environment of the container’s main process and searched for API keys, tokens, passwords, and database details. It then sent the results outward using tools, giving the operators fallback options if a particular utility or outbound route was blocked.

Attackers next retrieved an ELF payload, placed it in a temporary location, and named it to resemble a normal Linux service. They checked the host, inspected open ports, looked for competing miners, and accessed LiteLLM’s PostgreSQL-backed records.

The pattern mirrors earlier attacks on container environments, where exposed management interfaces can become a shortcut to host access.

In a related case, Docker endpoint mining campaign showed how cryptojackers steal secrets, add access mechanisms, and remove rival miners after entering a cloud workload.

RAGFlow faced a different form of abuse. Microsoft observed possible server-side request probing, followed days later by code execution and a hidden Python hook added to the application’s LLM configuration path.

Each time an administrator configured a provider, the hook could silently capture the API key, model name, provider type, and endpoint information.

Persistence and Mining Risks

In the Kestra incident, attackers likely exploited CVE-2026-49869, a critical authentication-bypass flaw, to create a malicious workflow and make the worker run shell commands.

They examined the Docker socket and container environment data, then downloaded and ran XMRig to mine Monero using the victim’s CPU.

Persistence made each intrusion harder to clean up. Microsoft recorded service-account SSH key changes, cron manipulation, hidden temporary relays, service-like names, restart loops, and immutable file attributes.

RAGFlow’s altered startup path could reload its credential-stealing hook when the service restarted, while the miner in Kestra was launched to survive the original shell session.

The immediate response should be to patch exposed AI services, rotate any keys connected to a reachable or compromised gateway, and review database and provider-account activity.

Teams should also look for unexpected shell or Python processes launched by AI applications, especially where they coincide with secret access, writes to application files, or unusual outbound connections. Microsoft recommends treating AI gateways as stores for the most sensitive secrets.

Organizations should require authentication for application and management surfaces, keep admin ports off the public internet, use separate limited-purpose service accounts, and place databases behind private, restrictive network paths.

Provider keys should be stored in a managed secrets system rather than process environment variables, with separate virtual keys and spending limits for teams. Finally, outbound connections should be denied by default and limited to required services.

Logging DNS callbacks, raw-IP traffic, changes to SSH authorized_keys and cron jobs, and execution from writable temporary folders can expose a connected attack chain before stolen access turns into sustained mining or expensive model misuse.

Readers tracking AI credential theft plugins can see why fast revocation and usage monitoring matter once a key leaves its intended environment.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4 address	45.150.109[.]151	Campaign-associated infrastructure
IPv4 address and port	135.125.10[.]56:19888	Campaign-associated infrastructure
IPv4 address and port	172.232.38[.]92:32991	Campaign-associated infrastructure
IPv4 address	47.86.197[.]116	Campaign-associated infrastructure
IPv6 address	2001:41d0:701:1100::adfd	Campaign-associated infrastructure
Domain	45.150.109.151.sslip[.]io	DNS rebinding infrastructure used in the campaign
Domain and port	auto.c3pool[.]org:443	Monero mining-pool infrastructure
Domain	yosemite[.]jp	Out-of-band callback infrastructure
Domain	gobygo[.]net	Out-of-band callback infrastructure
Domain	oast[.]me	Out-of-band callback infrastructure
Domain	oast[.]pro	Out-of-band callback infrastructure
Domain	oast[.]fun	Out-of-band callback infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC