A new report out today from Google LLC’s Mandiant and Google Threat Intelligence Group finds that attackers who hijack enterprise access to large language models are running up fraudulent cloud charges of more than $100,000 in a single day.
The report, “The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources,” covers multiple LLMjacking cases Mandiant responded to this year. At some organizations, the cumulative bill reached $1 million before access was revoked.
Cryptojacking, the older way of stealing cloud compute, tends to drain resources gradually. LLMjacking charges can spike in a matter of hours.
Victims in North America, South America and Asia-Pacific included financial services and retail companies, along with technology and transportation businesses. GTIG has tied the intrusions to several financially motivated clusters and sees a growing split between the people who break in and the operators who resell the access.
In most of the investigations, attackers got in with cloud identity credentials that had been stolen or left exposed, including service account keys and GitHub personal access tokens. Others went after LLM endpoints left open to the internet, such as exposed Ollama servers.
A group tracked as UNC6993 broke into a cloud instance through a misconfigured service account key and used that foothold to reach an LLM application programming interface. A fake portal it hosted posed as a sign-up page for a group of LLM users. Visitors were sent to the real LLM service and told to paste back a raw JSON payload containing an active access token. With that token, passwords and multifactor authentication no longer stood in the way.
Another actor scraped LLM API keys from public GitHub repositories and tested each one with a request capped at a single output token. Requests that small slipped under the volume-based alerts in the victims’ security monitoring tools.
Routing software is a target too. In one case a follow-on cluster obtained pre-validated virtual keys from the group that had established access, then exploited a user ID rebind flaw in LiteLLM’s key regeneration endpoint. The bug, CVE-2026-40217, let it turn ordinary virtual keys into master administrator credentials for the victim’s gateway.
Some of the stolen access was burned through directly. UNC6993 tried to generate more API keys and switch on extra services inside victim cloud projects, and the charges quickly passed $100,000. A different actor signed victim accounts up for pay-as-you-go agreements on premium models. To get around rate limits, the actor used what GTIG calls a “burn and rotate” strategy, continuously creating and deleting short-lived service accounts.
A third went further and planted a containerized backdoor built on the Manus agent framework, which asked an upstream model to reason through instructions and then executed the resulting commands on the compromised host.
Other access ends up for sale through what GTIG calls “LLM Mixers.” These operations run stolen credentials through open-source API gateways and custom relays so usage can be metered and the origin of each request hidden. UNC6993 used tools such as new-api and gcli2api, likely to pool stolen keys, and GTIG believes the group sells access through underground storefronts.
One mixer is Jet Night, a token routing service. An actor that made more than 500,000 LLM API calls in under eight hours was using stolen third-party keys to power it, and one victim organization was left with nearly $1 million in token costs.
Jet Night sells an unlimited plan claiming frontier model access for about $60 a month. Comparable consumer plans typically cost $100 to $250, and GTIG thinks prices that low only work on stolen keys. Outages advertised on the service’s Telegram channel are likely the result of victims finding the compromise and revoking keys.
GTIG expects attackers increasingly to favor LLMjacking over cryptojacking because the mixers pay out quickly and at high margins. Exposed API tokens and model routing middleware will draw more automated targeting as companies put higher-tier models and agentic workflows into production, the report predicts.
On the defensive side, the report notes that in several of Mandiant’s cases, the victim had never enabled LLM services. Attackers used stolen keys to turn on services such as Amazon Web Services Inc.’s Amazon Bedrock and Google’s Gemini API, and a bill could balloon within minutes from there.
Any unauthorized enablement should be treated as a critical security event, it says. Spending caps, API keys scoped to specific models and environments and log monitoring for the single-token pings used to validate stolen keys are among its other recommendations.
Threat actors want artificial intelligence to give them scale over defenders, according to John Hultquist, chief analyst at Google Threat Intelligence Group, and they are getting it with agentic tools and tokens stolen from unwitting third parties.
“Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks,” Hultquist said.