|
◆ A NOTE FROM THE DESK
No sponsor this week. By choice. Operatives, the only ads on offer this week were for online gambling platforms. The Fraudfather does not take a moral stand on how an adult spends their time or their money, and he is not about to start. He also does not rent the Dead Drop to a product that is, in the end, the old way to lose money dressed in a fancy interface. This newsletter is about protecting and growing your wealth. It is not in the business of selling you new ways to lose it. The slot stays empty. We will be back next week. |
The Dead Drop
FRAUD · POWER · PSYOPS
AI compute is inventory now. The bill is just paperwork.
|
A three-person dev team in Mexico woke up to $82,314.44 in unauthorized Google Gemini charges, run across 48 hours, against a normal monthly spend of $180. Microsoft sued a four-country syndicate this year for industrializing the same theft across Azure, OpenAI, and a dozen other model surfaces. A marketplace in the Netherlands now resells stolen access to more than 30 LLM providers, paid in crypto and PayPal. The bill is the visible damage. The signal is that AI access has become inventory.
Scene 1: The Bill.
On the morning of February 13, 2026, three developers in Mexico opened their Google Cloud console and saw a number that did not belong to them. $82,314.44. The charges had landed in two days. The line items pointed to Gemini 3 Pro Image and Gemini 3 Pro Text. The team's normal monthly spend was $180. They had not made the calls. Someone had. And somewhere between the API key and the billing system, the charges had cleared as if nothing about the request was unusual, because in every way the system could measure, nothing was. The key was valid. The endpoint answered. The meter ran.
Scene 2: The Storefront.
In December 2025 a researcher at Pillar Security set out honeypots, fake LLM endpoints meant to look like the soft underside of an enterprise. In 40 days they took 35,000 attack sessions. The traffic led back to a commercial gateway calling itself silver.inc, hosted on bulletproof infrastructure in the Netherlands and marketed across Discord and Telegram. The operator went by Hecker. The product was access. A subscriber could route inference through more than 30 model providers, AI21, Anthropic, AWS Bedrock, Azure OpenAI, Mistral, Vertex, OpenAI, ElevenLabs, and pay in crypto or PayPal. Pillar named the campaign Operation Bizarre Bazaar. The name flatters the marketplace. The thing itself is a wholesale supplier.
Scene 3: The Defendants.
Microsoft sealed a complaint in the Eastern District of Virginia in December 2024 and unsealed an amended one on February 27, 2025, naming four men on three continents. Arian Yadegarnia in Iran, alias Fiz. Alan Krysiak in the United Kingdom, alias Drago. Ricky Yuen in Hong Kong, alias cg-dot. Phat Phung Tan in Vietnam, alias Asakuri. Two more defendants in Illinois and Florida sit under seal pending criminal referral. Microsoft calls the network Storm-2139. The complaint describes a three-tier business, Creators who built the bypass tools, Providers who modified and resold them, Users who consumed cheap inference. The case is civil. There have been no arrests, and as of this week there are no criminal charges. The law is two years behind the meter.
| GM, WELCOME BACK TO THE DEAD DROP. |
Operatives, last week the file was the opt-out. 38 companies, 8 documented ways to make a right impossible to use, an address that stayed in circulation until a man with a notebook came to a legislator's door. The thing the citizen had been told was his protection was a prop.
This week the file is the meter. The opt-out turned your address into a product because the law treated information as an asset and refused to ask who got to mint it. The same architecture has come for compute. An API key, the kind a developer wrote into a side project at midnight, has quietly become a payment instrument. A free trial has become wholesale inventory. A session cookie has become a wire transfer. The model itself, the thing the headlines write about, is the smallest piece of the story. The interesting piece is the meter behind it, and who has learned to make it run for someone else's bill.
The Case. LLMjacking, the name the security industry has settled on, sounds technical. It is not. It is the conversion of someone else's AI access into your inventory, and the conversion is now systematic enough that researchers have named the marketplaces, indexed the prices, profiled the operators, and watched the gross merchandise volume grow by a documented 376% from one quarter to the next. The first agentic fraud market is here. It arrived as a cloud bill.
The Stakes. The headlines focus on the dev team in Mexico because the dev team is photogenic. The threat reaches further. The session cookie a Russian-Market vendor sells for $10 is yours, if your laptop has an infostealer on it. The Chrome extension that 900,000 people installed last winter was exfiltrating their conversations every 30 minutes. The OAuth consent screen that looked exactly like Microsoft, because it was served from Microsoft's own domain with a valid Microsoft certificate, was a phishing rig. This is not a developer problem. It is the next consumer fraud, and it is already running.
Same architecture as last week. A thing the public did not realize had become a product. A market sized for someone else. This week the product is your access. The bill arrives in your name.
The Operative's Observation
|
◆ THE OPERATIVE'S OBSERVATION
Jailbreaking attacks the model. LLMjacking attacks the meter. The first is a craft. The second is a business. The difference is the difference between a man who picks a lock to read the diary inside the house and a man who picks the lock to live in the house and put the utilities in your name. Every fraud generation has had its conversion. Card numbers became goods. Crypto keys became cash. Compute, until now, has been the boring kind of stolen, used to mine and to scrape. Model access is something new. It is a high-margin retail product that resells on Discord at .40 to .60 cents on the dollar of the official price, and at certain Chinese transfer stations as low as a dime. It has a catalog. It has a price list. It has subscribers. The platform sees usage. The billing system sees authorized consumption. The victim sees the loss. The actor was never named. Authority was answered after the bill, when it should have been answered before the request. This is the question the industry will spend the next decade learning to ask. Know Your Customer was the last era. Know Your Agent is this one, and the fraud crews understood it first. |
The Criminal Playbook
The supply chain is unromantic, which is what makes it dangerous. Begin where the supply begins. A developer leaves an OpenAI key in a committed file on GitHub at 11 p.m. on a Tuesday. The security firm GitGuardian, whose business is watching exactly this, has documented that bots find a newly committed key in under four minutes. A single startup that left an OpenAI key public for 11 days came back to a $67,000 bill, against a $400 monthly average. A solo developer with one careless commit lost $87,000 overnight. The key was the door. The bot was already inside before the developer had brushed his teeth.
From the supply, the access moves to validation. The crews run a Python tool called keychecker, an open-source script that tries each captured credential against Anthropic, Bedrock, Vertex, Mistral, OpenAI, and the rest, marks which models the key can reach, which regions it can call, and what the rate limit will bear. A key that runs Claude Opus is worth more than one that runs an old GPT. A key whose owner has logging disabled is worth more than one whose owner pays attention. The crews are pricing inventory, the same way a card-fraud crew once priced a Visa Platinum against a Visa Classic.
From validation, the access moves to product. The product, in most of the documented cases, is not a Bond villain. It is a chatbot. Sysdig's tracking of the original 2024 LLMjacking campaign found the dominant downstream demand was uncensored roleplay communities on platforms like JanitorAI, Venus, and the 4chan /g/ board's AICG threads, where users wanted Claude or GPT without the filter and without the bill. The crews satisfied both, sometimes through a piece of software called oai-reverse-proxy that hides the stolen key behind a chat front end, sometimes through hosted instances on HuggingFace, sometimes through a Rentry.co paste circulated like a speakeasy address. The same tool family resurfaced when DeepSeek shipped, and the proxy operators added DeepSeek-V3 within days of release and DeepSeek-R1 within 24 hours, watching model launches the way enterprise buyers watch them.
From product, the access moves to revenue. eSentire's research desk found a market called LLM Paradise selling around 400 stolen AI account credentials a day at roughly $10 each, with OpenAI accounts the most plentiful and Claude the most prized. silver.inc charges its subscribers a monthly fee. Operators at the higher end run, by independent estimate, $1 million-per-year businesses on stolen capacity, while the victim, a customer in Pennsylvania or New Jersey or Mexico City, eats the bill. Sysdig's first 2024 worst-case scenario set the burn rate at $46,000 a day. Bedrock incidents this year have run $18,000 a day per region and one Claude Opus victim saw a single model's charges hit $38,951.55 from one breach. The headlines now flirt with $100,000 a day for the top-tier incidents, and the flirtation is supported by the receipts.
From revenue, the access moves to the next door. The Gemini story is the cleanest illustration. Truffle Security found, late in 2025, that Google had changed the rules of its own API key system in a way no developer noticed, so that the keys originally treated as harmless project identifiers for Maps and Firebase could now authenticate to Gemini. The firm identified 2,863 such keys live on websites, and roughly 35,000 more extracted from mobile apps, every one of them a credential that was safe on Monday and a billing instrument on Tuesday. The platform did not steal the authority. The platform simply assigned it. The fraud lived in the gap between what the developer thought he had and what the credential could now do.
This is the place to look for the next decade of fraud, because the same gap is opening on every paid surface the AI economy touches. An MCP server given an OAuth scope. A delegated wallet handed to an agent. A subscription model that bills per call. A research project's API budget. A family-office assistant given Microsoft 365 access. Each one of those is an authority decision being made in the same casual posture as that midnight commit. Compute has become a resellable asset, and the systems that price it have not yet learned to ask who is allowed to spend it.
| ◆ |
Field Manual
How to keep your AI access from becoming someone else's inventory.
| 01 | Set a hard billing cap, not a soft alert. On every AI platform you use, OpenAI, Anthropic, Google AI Studio, Azure, Bedrock, set a maximum monthly spend that will refuse the next call when it is exceeded, not an email that arrives after the call has cleared. A soft alert tells you the meter ran. A hard cap stops the meter. The $82,314.44 Gemini bill cleared in 48 hours because the account had no ceiling. |
| 02 | Move from password and code to passkey or hardware key. A six-digit code is no match for a session cookie. The thief who buys your stealer log gets the cookie that bypasses your second factor altogether. A passkey, or a physical security key like a YubiKey, is bound to the device and cannot be carried away in a log file. Turn it on for OpenAI, Anthropic, Google, Microsoft, and any account you would not want a stranger logged into tonight. |
| 03 | Sign out of your AI accounts once a week. Every ChatGPT, Claude, and Gemini account keeps a list of active sessions in its settings. Clearing that list kills any cookie a thief is currently riding. The reset is one click. Do it on Sunday night while the coffee brews. A weekly purge is the cheapest insurance you will buy this year. |
| 04 | Audit your browser extensions monthly. Be ruthless. Two AI-helper extensions, with names like Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI, sat in the Chrome store with 900,000 combined installs through December 2025 and January 2026 while exfiltrating users' AI conversations every 30 minutes. Open your extension list tonight. Remove anything that asks to read every page. The convenience is not worth what you paid for it. |
| 05 | Review the apps you have given OAuth access to. Go to myaccount.google.com/permissions and account.microsoft.com. Read the list. Revoke any AI assistant, Copilot Studio agent, or productivity app you cannot remember installing. The Datadog disclosure named CoPhish serves fake Microsoft consent screens from real Microsoft domains. The fraud begins at the consent click. The protection begins at the revoke button. |
| 06 | Check the stealer logs, not just the breach lists. HaveIBeenPwned tells you when a service lost your password. It does not tell you when an infostealer harvested your laptop and sold your session cookies on Russian Market. Use a stealer-log checker, services like DeXpose or IntelBase, to look for active credential exposure. If your address appears, treat it like a fire. Rotate every important password, kill every active session, and start over. |
| 07 | If you use API keys, treat them like cash, not config. Never paste a key into a side project committed to GitHub. Never embed one in a Jupyter notebook you will share. Generate scoped, project-bound keys with a 90-day rotation, not account-level master keys. Store them in a real secret manager, 1Password CLI, Doppler, AWS Secrets Manager, or at minimum your operating system keychain. The bot will find a leaked key in under four minutes. You will not. |
| 08 | Treat every AI agent and MCP server like a vendor. The April 2026 disclosures put the number of vulnerable Model Context Protocol instances on the open internet near 200,000. Before you let an agent into your accounts, ask the questions you would ask a vendor. Who built it. Who reviewed it. What scope does it need. What scope does it want. Give it a dedicated low-privilege token, never your primary account. An agent you would not hire is an agent you should not install. |
|
◆ THE FRAUDFATHER BOTTOM LINE
Payment is not trust. Usage is not legitimacy. Authentication is not authority. |
|
◆ OPERATIVE TIP
Run the 30-minute AI hygiene drill this week. Not someday. This week. First 10 minutes. Log in to every AI account you pay for, OpenAI, Anthropic, Google AI Studio, Azure, Bedrock, and set a hard monthly billing cap. Not a notification. A cap. Next 10 minutes. Open the active sessions screen on each of those accounts and sign out of everything. Then turn on a passkey or a hardware key, whichever the platform supports. Last 10 minutes. Open your browser's extension page. Remove every AI helper you do not remember installing. Open myaccount.google.com/permissions and revoke every connected app you do not actively use. Set a recurring calendar reminder for the first of every month, titled "the meter is still running." An AI account you set up once and never audited is an inventory item waiting to be sold. An AI account you check on a schedule is a control. |
|
GRAY MATTERS · THE FIRST AGENTIC FRAUD MARKET
When the Receipt Arrives Before the Verdict.Every fraud era is defined by what it converts. The check-kiting era converted float into cash. The card era converted a sixteen-digit number into goods on a doorstep. The crypto era converted a private key into instant, irreversible money. Each conversion took years for the law to learn, and in the lag, the operators ran free. The agentic era converts authority into inventory. An API key is a permission slip. A session cookie is a permission slip. An OAuth scope is a permission slip. A wallet signature is a permission slip. None of them, in the systems we have built, are checked against the actual person who is supposed to be making the request. They are checked against themselves, the way a doorman checks that a ticket matches the show, not that the person holding it is the one who bought it. The platform sees a valid ticket. The platform admits the holder. The bill is sent to whoever the ticket was issued to. The actor is never named. Look at the Truffle finding again, because it is the cleanest illustration in the file. The key the developer wrote into his Maps app in 2022 was, by the platform's own design, not a secret. It was a project identifier. By 2026, the same key, untouched, could authenticate to Gemini and run paid inference. Nothing the developer did had changed. The platform had quietly extended the authority of the credential past the boundary the developer had agreed to. The fraud crews noticed the extension. The developer did not. The bill arrived at his door. The conversion of authority into inventory had been performed by the platform itself, and the criminal only had to read what was already on the floor. An admission layer is the question a system asks before the meter starts running. Every fraud era we have ever lived through is what happens when the system forgets to ask it.
The metered internet is going to multiply this problem. As agents consume APIs and tool calls and dataset reads and image generations and x402 payments on your behalf, the unit of fraud will shrink to a fraction of a cent and the volume will balloon to millions of events per minute. The investigators of the future will not be looking at a single $82,000 charge. They will be looking at a flood of small, syntactically valid, individually unreviewable requests, each of which was paid for by an account that did not authorize them. The cards industry took decades to build the rails that ask, in real time, whether a charge belongs to the cardholder. The AI industry has not yet built the equivalent rail. The thieves have been waiting on the dock. Know Your Customer was the last era. Know Your Agent is this one. The questions are not exotic. Who is the principal behind this actor. Which specific agent or script is making the call. What is it authorized to consume. Is the environment legitimate. Has the actor, or the cluster around it, behaved well elsewhere. They are the same questions a bank asks before approving a wire, asked in the place where the wire used to be a chatbot prompt and a $0.003 API call. The platforms have not built the apparatus. The fraud crews have already drafted the agenda. Microsoft sued. The DOJ has not. The receipt arrived before the verdict. Stay sharp.
The Fraudfather
|
The Pardon Ledger
Week 10 of a continuing record.
|
CRIMINAL CHARGES FILED
0
Federal indictments against the named Storm-2139 defendants since Microsoft's amended civil complaint in February 2025.
|
LETTERS ANSWERED IN PUBLIC
0 of 17
Eleven days past the May 22 deadline, none of the 17 pardon recipients has responded to the Min, Ruiz, and Welch inquiry.
|
The justice.gov clemency page has not posted a new financial-crime grant since the winter batch. The Ledger keeps its column. This week the column tracks the same disease on a different surface, because the two stories have started to rhyme.
The parallel. Microsoft has sued a four-country syndicate for industrializing the theft of cloud AI. The complaint names defendants in Iran, the United Kingdom, Hong Kong, and Vietnam, and describes a three-tier business that drained the prepaid Azure OpenAI accounts of American companies in Pennsylvania and New Jersey. The complaint is civil. There are no criminal charges. There are no arrests. The Department of Justice has not appeared in the matter. The corporation, owning the platform, has acted. The state, owning the law, has not.
The same vacuum the Ledger has documented week after week, the financial-crime conviction quietly wiped, the answer to a congressional letter never made public, has now reproduced itself in the new fraud era. The fraud has scaled. The prosecution has not. The pattern is not partisan and not new. It is the standing condition. The Ledger remains the record, because in this story the record is, again, the only thing that is keeping count.
|
◆ SPREAD THE SIGNAL
Someone you love still thinks their AI account is just an account.They saved the password. They installed the helper. They clicked the consent. They did not know any of it had become a payment instrument. Send them the Dead Drop and the 30-minute drill. The fraud crews are already pricing the inventory. SEND THEM THE DEAD DROPEYES ONLY.
FORWARD WITH CARE. |
Stay sharp. Trust slowly. Verify everything.
The Fraudfather
This newsletter is for informational purposes only and promotes ethical and legal practices.
This newsletter is for informational purposes only and promotes ethical and legal practices.
