Attackers who take over enterprise access to large language models are generating fraudulent cloud charges exceeding $100,000 in a single day, according to a new report from Google LLC's Mandiant and the Google Threat Intelligence Group. In some of the LLMjacking cases Mandiant handled this year, the cumulative bill at an organization reached $1 million before access was revoked. The victims span financial services, retail, technology and transportation businesses across North America, South America and Asia-Pacific.
The report, The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, describes an intrusion pattern that differs sharply from cryptojacking, the older method of stealing cloud compute. Cryptojacking drains resources gradually, while LLMjacking charges can spike within hours. GTIG has tied the intrusions to several financially motivated clusters and sees a growing divide between the actors who break in and the operators who resell the access.
Most of the investigated cases began with stolen or exposed cloud identity credentials, including service account keys and GitHub personal access tokens. Others targeted LLM endpoints left open to the internet, such as exposed Ollama servers. A group tracked as UNC6993 entered a cloud instance through a misconfigured service account key and used it to reach an LLM application programming interface. Its fake portal posed as a sign-up page for LLM users, sending visitors to the real service and asking them to paste back a raw JSON payload containing an active access token, which bypassed passwords and multifactor authentication.
Another actor scraped LLM API keys from public GitHub repositories and tested each one with a request capped at a single output token, keeping the traffic under volume-based alerts in victims' security monitoring tools. A follow-on cluster obtained pre-validated virtual keys and exploited a user ID rebind flaw in LiteLLM's key regeneration endpoint, tracked as CVE-2026-40217, to turn ordinary virtual keys into master administrator credentials for a victim's gateway. Some stolen access was consumed directly: UNC6993 tried to generate more API keys and enable extra services in victim cloud projects, while another actor signed victim accounts up for pay-as-you-go agreements on premium models and used a burn and rotate strategy of creating and deleting short-lived service accounts to evade rate limits.
Other access is sold through operations GTIG calls LLM Mixers, which run stolen credentials through open-source API gateways and custom relays so usage can be metered and request origins hidden. UNC6993 used tools such as new-api and gcli2api, likely to pool stolen keys, and GTIG believes the group sells access through underground storefronts. One mixer, Jet Night, offers an unlimited plan claiming frontier model access for about $60 a month, against comparable consumer plans typically costing $100 to $250; GTIG believes such prices are only possible with stolen keys. An actor made more than 500,000 LLM API calls in under eight hours using stolen third-party keys to power the service, leaving one victim organization with nearly $1 million in token costs.
The report notes that in several Mandiant cases the victim had never enabled LLM services, and attackers used stolen keys to turn on offerings such as Amazon Web Services Inc.'s Amazon Bedrock and Google's Gemini API, with bills ballooning within minutes. It recommends treating unauthorized enablement as a critical security event, along with spending caps, API keys scoped to specific models and environments, and log monitoring for the single-token pings used to validate stolen keys. John Hultquist, chief analyst at GTIG, said threat actors want artificial intelligence to give them scale over defenders and are achieving it with agentic tools and tokens stolen from unwitting third parties.
More company and startup news from TechManNews.
