Google and Mandiant warned on Monday that cybercriminals are hijacking business cloud setups to steal access to costly artificial intelligence models [3]. The tactic, known as LLMjacking attacks, lets unauthorized users run heavy prompts through stolen API keys while passing computing bills to legitimate account owners [2]. Unlike older cryptojacking schemes that quietly siphoned server power over months, these intrusions generate sudden billing spikes exceeding $100,000 in a single day [3]. In several cases, targeted firms racked up more than $1 million in charges before uncovering the compromise [1].
How LLMjacking Attacks Drain Cloud Budgets
The findings come from a joint report titled The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, authored by Google’s Threat Intelligence Group (GTIG) and Mandiant [3]. GTIG tracked intrusions across North America, South America, and Asia-Pacific. Victims included retail, finance, technology, and transit companies [2]. When hackers hijack these setups, query volume can jump immediately past 1,000 calls a second. Cloud hosts log every request as real traffic, charging the victim for all generated tokens [1]. Because frontier models cost so much per token, high-speed automated scripts can drain quarterly budgets over a single weekend [3].
Why are hackers shifting from coin mining to foundation models? Rogue crypto mining needs immense raw power, and cloud monitoring tools spot mining containers almost instantly. Stolen model tokens, by contrast, blend easily into normal developer activity while offering fast cash on black-market forums [2].
Costs mounted fast. One victim took on $100,000 in a single day after hackers broke into its cloud project [3]. Another firm faced a total bill of nearly $1,000,000 after an intruder pumped over 500,000 requests through a hijacked connection in less than eight hours [1]. John Hultquist, chief analyst at Google Threat Intelligence Group, explained that attackers want scale over defenders. “Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks,” Hultquist said [3].
Stolen Credentials and Exposed Endpoints
Hackers find several easy ways inside [2]. Most attacks start with exposed cloud identity logins, including misconfigured Identity and Access Management (IAM) keys, service account keys with broad project permissions, and GitHub personal access tokens. Intruders also scan the web for unprotected servers, such as exposed Ollama systems running without password checks [3].
Google tracked one aggressive cluster under the name UNC6993, which breached a target cloud instance using an improperly secured service account key. The group created a fake portal disguised as a signup page for an enterprise model user group. When employees visited the site, it directed them to log into their legitimate service account and paste back a raw JSON payload containing an active session token. That single token let UNC6993 bypass multi-factor authentication (MFA) safeguards and password checks completely. With access secured, the group created fresh API keys inside the victim project, running up over $100,000 in unauthorized usage [2].
To stay inside, intruders alter routing tools and virtual machines. Hackers exploited flaw CVE-2026-40217 in LiteLLM, a proxy tool used to manage model traffic [1]. That bug let attackers turn normal virtual keys into master administrator logins for the whole routing gateway [3]. In other hacks, crews planted backdoors built on the Manus agent framework or used custom Node.js bundles under the persona D1337-KAIROS to expose public model proxies [1].
Illicit Token Resale Through LLM Mixers
Cybercrime rings have split into distinct roles. Google observed “two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure”. First-stage brokers steal keys and find open servers, then sell that unauthorized access to secondary crews running illicit routing hubs known as LLM mixers [1]. Mixers use tools like new-api, gcli2api, and newapi[.]pro to pool stolen keys and hide traffic origins [3]. Subscribers send prompts to the mixer, which relays queries through victim cloud accounts while masking the real source.
One major outlet was Jet Night, which ran at jet-night.com [1]. Jet Night sold unlimited plans for frontier models for about $60 a month [2]. Normal consumer plans cost $100 to $250 [3]. Google analysts said Jet Night could only charge $60 because it paid nothing for compute, sticking a single victim firm with nearly $1 million in token bills [1].
Mixers use smart evasion tactics to keep running without detection during LLMjacking attacks. Some actors scrape keys from public GitHub repositories, testing each token with a tiny prompt capped at a single output token to stay beneath volume-based fraud alerts [3]. When scaling up, actors use a “burn and rotate” plan, constantly creating and deleting short-lived service accounts to bypass provider rate limits and avoid volume-based fraud detection [2]. When victims spot the theft and revoke keys, Jet Night posts outage notices on Telegram while finding fresh logins [3].
Grey Market Relays Target Coding Assistants
Illicit token proxying reaches beyond web chats into developer tools. A related investigation by Broadcom-owned Symantec and Carbon Black revealed an unauthorized relay service operating since early 2026. The scheme targets corporate engineers who want to run tools like OpenAI Codex and Anthropic Claude Code command-line interfaces (CLIs) [2].
Because Western AI vendors do not sell coding assistants in parts of Asia, developers in Mainland China and regional subsidiaries across South Korea, Malaysia, and Taiwan turned to grey-market sellers. The scheme breached dozens of Asian manufacturing plants. Rather than delivering trojanized binaries that might trigger antivirus software, the ring tells users to install official CLI packages through npm and run a single terminal command pulling setup scripts from vibe.aiok[.]me. “Rather than building its own client software, the service repurposes the genuine CLI tools,” Symantec said [2].
The script checks local Windows language settings before modifying configuration files at ~/.codex/config.toml or ~/.claude/settings.json. It switches off local execution sandboxes, setting Codex to danger-full-access mode, and routes every code suggestion through third-party servers. Unlike consumer mobile security where the Android system adds AI defenses against messaging scams to protect individual devices, enterprise defenses must stop unauthorized scripts from exposing developer machines to external relays. While Symantec found no proof of code theft, routing business logic through unverified servers creates grave security risks [2].
Defending Enterprise Clouds Against LLMjacking Attacks
Defending against rogue model usage starts with knowing that hackers can turn on expensive cloud services without warning. In several intrusions investigated by Mandiant, victimized firms had never intentionally used artificial intelligence tools, but hackers used stolen account keys to switch on Amazon Web Services features like Amazon Bedrock or Google’s Gemini API, generating massive invoices in minutes [3]. Google considers any unsanctioned activation a critical security incident [1].
To block these paths, security teams must tighten identity governance. Admins should deny all cloud permissions that are not strictly necessary for an employee’s role, specifically disabling access to foundation models for standard service accounts across production environments. Firms can enforce phishing-resistant multi-factor authentication (MFA) and keep keys in central secret vaults [1]. Engineering teams should also search public code repositories like GitHub for leaked tokens and block hardcoded credentials before deployment [2]. Strict access limits shut down the easiest paths for intruders.
Finally, firms need unified billing and security checks to catch usage surges early. Hard spending limits and daily billing alerts stop runaway charges before they reach six figures [1, 3]. Cloud audit and inference logs must be watched for single-token pings, rapid service account creation, and attempts to turn off logging tools [1]. As cybercrime groups turn to LLMjacking attacks to fund their work, securing cloud AI access has become an essential priority for corporate defense.
- ONLINE NEWS Toulas, B. (2026, November 3). Google: LLMjacking attacks rack up $1 million in cloud AI charges. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 3). Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges. The Hacker News. [Article Link]
- ONLINE NEWS Riley, D. (2026, November 2). Google finds ‘LLMjacking’ attackers running up $100K a day in fraudulent cloud charges. SiliconANGLE. [Article Link]
