Ethical Hacking News
Chainalysis, a leading blockchain analysis firm, recently suffered a massive breach of user credentials, resulting in the shutdown of several key services. The breach exposed sensitive user information, including names, usernames, password hashes, and live tokens for all users. The company has implemented additional proactive monitoring systems to detect unusual activity and has taken steps to protect its users' sensitive information. However, the incident highlights the growing threat of AI-driven attacks, which are becoming increasingly sophisticated and difficult to detect. As a result, it is essential for organizations to take proactive measures to protect their sensitive information and to stay vigilant against emerging threats.
[key_points]
Chainalysis suffered a massive breach of user credentials, forcing the company to shut down several key services.The breach exposed sensitive user information, including names, usernames, password hashes, and live tokens for all users.Chainalysis has implemented additional proactive monitoring systems to detect unusual activity and is working to restore access to affected services.Microsoft reported that threat actors are using AI-driven attacks to target companies, including Chainalysis, and steal sensitive information.Threat actors are using AI to exfiltrate data from Azure Key Vault and access Microsoft Entra ID tenants, as well as SharePoint and OneDrive.A new business model has emerged, where cybercriminals steal cloud access to commercial large language models (LLMs) and resell it to paying customers.The LLMjacking ecosystem creates a market for stolen enterprise model access, making it easily monetizable and driving more actors to undertake operations to steal credentials.
The recent cyberattack on the blockchain analysis firm Chainalysis has resulted in a massive breach of user credentials, forcing the company to shut down several key services. According to the latest information, Chainalysis, a leading firm in the field of blockchain analysis, recently disclosed that its ongoing investigation into a sophisticated cyberattack on its systems also exposed sensitive user information, including names, usernames, password hashes, and live tokens for all users.
The company stated that, while investigating the incident, they removed access to Reactor and Data Solutions. However, at this time, they continue to have no evidence that any investigation data has been accessed or that Chainalysis attribution data has been manipulated. In an effort to mitigate the impact of the breach, Chainalysis has implemented additional proactive monitoring systems to detect unusual activity.
Furthermore, the company has taken the Know Your Transaction (KYT) user interface and API offline, alongside other address screening products and the login page. This step is aimed at preventing potential misuse of the compromised credentials. The development comes less than a week after Chainalysis disclosed that it was the target of a cybersecurity incident in which an external actor leveraged offensive agentic techniques to obtain unauthorized access to its systems and internal tools.
In the wake of the incident, Chainalysis has taken several measures to protect its users' sensitive information. The company intends to begin restoring access to KYT and Address Screening, urging customers to contact its support email or their Chainalysis account team with trusted IP addresses, which will be added to an allowlist. From there, users can reset their passwords and rotate API keys to register transactions.
It's unclear who is behind the attack, but Chainalysis notes that it was similar to "many other tech platforms in recent weeks." The company has emphasized the need for users to take proactive measures to protect their sensitive information. It's worth noting that Chainalysis is not the only firm to have been targeted by such an attack. A number of companies, including Chainstack, OpenCode, Warp, and WorkOS, have disclosed that they have been targeted by AI-driven attacks, some of which involve an autonomous penetration testing tool called ARTEX.
According to Microsoft, threat actors are using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, such as credentials, application credentials, and AI inference-related API keys across multiple applications and cloud services. This allows threat actors to not only scan for secrets at a quicker pace but also use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for hands-on-keyboard interactions throughout the attack chain.
In at least one case, an AI agent is said to have progressed from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes. The activity is assessed to be ongoing from August 2026. Some aspects of the campaign correspond to post-exploitation activity involving the misuse of valid application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources.
The sign-in events originated from two IP addresses, 199.19.77[.]84 and 199.19.77[.]18. The threat actor targeted operations that return credentials, including storage account keys, App Service settings, connection strings, and publishing credentials, AI and machine learning (ML) connections, and datastores, and Azure Kubernetes Service (AKS) user credentials. The compromised applications subsequently accessed SharePoint and OneDrive in the targeted organization tenants, including file downloads and mailbox-item access.
Furthermore, the threat actor has been observed attempting to steal Azure resources, including compromised Azure AI services, likely as part of efforts to facilitate broader attack activity. Another notable aspect of the campaign is that the agentic AI tools have been found obtaining a token for a single-tenant OAuth application in the same target organization, then use the compromised OAuth application to enumerate other cloud resources within the organization.
In a handful of cases, Microsoft said it observed the agents exfiltrating secrets from the organization's Azure Key Vault. The development also coincides with a surge in attacks targeting AI developer platforms over the past month, allowing threat actors to resell access, abuse them as free compute (i.e., LLMjacking), and use them as attribution cover for further attacks.
In a report published this week, Google disclosed that cybercriminals have established a business model out of stealing cloud access to commercial large language models (LLMs) and reselling it to paying customers. The monetization infrastructure centers on LLM Mixers, who act as an illicit intermediary to advertise access to compromised enterprise LLM accounts on underground markets without their customers needing to set up their own legitimate API credentials or cloud infrastructure.
In other words, LLM mixers turn stolen enterprise model access into a criminal routing gateway for paying subscribers, while the legitimate owner's systems continue to accept requests. These services help proxy requests across stolen accounts, distribute consumption, and obscure the original source of access.
The emerging LLMjacking ecosystem "create[s] a market that makes the theft easily monetizable, likely driving more actors to undertake operations to steal credentials," Wiz said. In at least two cases, Microsoft identified at least two resale operations leveraging stolen AWS Bedrock keys obtained from two different organizations – llm-routing[.]com (momo) and xingjiabiapi[.]org – both of which offer a wide selection of frontier models for discount prices.
However, there is no evidence that the operators of these websites were responsible for the initial platform compromises. Interestingly, the IP address linked to llm-routing[.]com, 23.106.46[.]239, hosted an Artex landing page in mid-October 2026 and has been flagged by Zeabur as an indicator of compromise. Last month, Zeabur disclosed a security breach in which an unknown threat actor exploited credentials stored in plaintext to compromise its infrastructure, exfiltrating over 3.2 million environment variable records and data associated with 321,810 accounts.
The following IP addresses have been used to test stolen keys and are suspected to be linked to LLM token abuse and resale - 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201. Threat actors are not only using AI as a tool to conduct attacks, they are also compromising victim environments solely to abuse their finances for mass Large Language Model (LLM) execution, incurring hundreds of thousands of dollars in AI API charges.
Related Information:
https://www.ethicalhackingnews.com/articles/Chainalysis-Breach-Exposes-All-Users-Credentials-Forces-Shutdown-of-Key-Services-ehn.shtml
https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html
Published: Fri Nov 6 03:52:57 2026 by llama3.2 3B Q4_K_M
