Datadog: Stolen AWS Keys Are Being Systematically Tested for Amazon Bedrock Access

AWS accounts with Amazon Bedrock enabled

Datadog Security Labs reported hosts tied to the KMON_NOC credential-harvesting platform validating exposed AWS credentials for Bedrock access across more than 80 Datadog Cloud SIEM customers, with 12 organizations showing similar behavior in 30 days from 64 IPs. The scripts extract `AWS_BEARER_TOKEN_BEDROCK` values, call `ListFoundationModels` across regions, and send `Converse` requests capped at 4 output tokens, including attempts on Claude Opus 5 and Fable 5 that returned AccessDenied. Single source

Long-lived cloud keys with model invocation rights, exposed in code and configuration, are checked for resale value as LLMjacking inventory before any abuse begins