AI Service Proxies
Sub-technique of AML.T0008 Acquire Infrastructure
Description
Adversaries may utilize commercial proxy services that resell access to AI services such as frontier model APIs.
This infrastructure can be used to conduct large-scale campaigns to perform Exfiltration via AI Inference API via distillation. Adversaries may also use this infrastructure to Generate Malicious Commands for offensive cyber operations, or to generate content for Spearphishing via Social Engineering LLM.
Commercial AI service proxies distribute traffic from different accounts and various cloud platforms. The mix of traffic can make malicious activity difficult to detect and block[[anthropic]].
Malicious actors conduct LLM Jacking attacks to gain access to victim accounts which they then resell access to in their proxy services[[sysdig]].
- ATLAS ID
- AML.T0008.005
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique; see the parent technique.
Case studies that use it
Related ATT&CK technique
ATLAS references this ATT&CK technique on the parent technique.