LLMjacking: What It Is and How the Attack Inflates Cloud Bills

Update, November 3, 2026: we added Google’s original report to the sources and removed the items on Synology and Siemens, which were about other vulnerabilities, and the questions that repeated the text.

LLMjacking means hijacking a company’s access to a large language model (LLM, the type of system behind chatbots) so that it works at the victim’s expense. According to a report from Mandiant and the Google Threat Intelligence Group (GTIG), fraudulent cloud costs can exceed $100,000 in a single day.¹² At some of the affected organizations, the total charges reached one million dollars before the access could be blocked.²

What is LLMjacking and how does it differ from cryptojacking?

The report, devoted to the growth of LLMjacking and the way criminals profit from compromised cloud resources and models, brings together several cases handled by Mandiant over the course of the year.² Cryptojacking, meaning the theft of cloud computing power to mine cryptocurrency, tends to drain resources gradually. With LLMjacking, by contrast, costs can spike within a few hours.² The victims are located in North America, South America and Asia-Pacific and include financial services firms, retail companies, technology businesses and transport companies. GTIG links the intrusions to several financially motivated groups and notes a growing separation between those who break into systems and those who resell the access.²

How do attackers get access?

In most investigations the attackers got in with stolen or exposed cloud identity credentials, including service account keys and GitHub personal access tokens. Others targeted LLM endpoints left open on the internet, such as unprotected Ollama servers.² A group tracked as UNC6993 entered a cloud instance through a misconfigured service account key and from there reached an LLM’s application programming interface (API). It also hosted a fake sign-up portal for an LLM user group: visitors were sent to the real service and invited to paste a block of JSON data containing a live access token. With that token, passwords and multi-factor authentication were no longer needed.² Another actor collected API keys from public GitHub repositories and tested them one by one with requests limited to a single output token. Requests that small slipped past the volume-based alerts in the victims’ monitoring systems.² The software that routes requests to the models is also in the crosshairs. In one case a group exploited a flaw in LiteLLM, catalogued as CVE-2026-40217, to turn ordinary virtual keys into administrator credentials for the victim’s gateway.²

What do they do with the stolen access?

Part of the access is consumed directly. UNC6993 tried to generate more API keys and enable additional services in the victims’ cloud projects, and the charges quickly exceeded $100,000.² Another actor enrolled the victims’ accounts in pay-as-you-go contracts for top-tier models. To get around request rate limits it used a strategy GTIG calls “burn and rotate”: it continually creates and deletes short-lived service accounts.² A third installed a backdoor in a container, based on the Manus agent framework. The program asked an external model to reason about the instructions and then executed the resulting commands on the compromised system.²

What are “LLM Mixers” and who buys the access?

GTIG calls “LLM Mixers” the services that pass stolen credentials through open-source API gateways and custom relays. This way usage can be metered, while the origin of each request stays hidden.² UNC6993 used tools such as new-api and gcli2api, probably to pool the stolen keys, and according to GTIG it sells the access in underground market shops.² One example is Jet Night, a token-routing service. An actor feeding it with other people’s stolen keys made more than 500,000 API calls in under eight hours, and one victim ended up with token costs close to one million dollars.² Jet Night offers an unlimited plan with access to frontier models for about $60 a month, compared with $100-250 for comparable consumer plans. GTIG believes such low prices are sustainable only with stolen keys; this is the group’s assessment, not an independently verified fact.²

How can companies defend themselves?

In several cases the victim had never enabled LLM services: the attackers used stolen keys to switch on services such as Amazon Web Services’ Amazon Bedrock and Google’s Gemini API. From there the bill could grow within minutes.² For this reason the report calls for treating every unauthorized activation as a critical security event. Other measures it lists include spending limits, API keys tied to specific models and environments, and checking logs for single-token requests used to validate stolen keys.² John Hultquist, GTIG’s chief analyst, argues that criminals are looking to artificial intelligence for a scale that gives them an edge over defenders. Securing these resources, he said, protects against runaway costs and also against the wave of low-cost autonomous attacks.²

Why could the phenomenon grow?

GTIG expects attackers to increasingly prefer LLMjacking to cryptojacking, because the mixers pay quickly and with high margins. Exposed API tokens and model-routing software will attract more automated attacks as companies put higher-tier models and agent-based workflows into production.²

This article was written by artificial intelligence from the sources cited, without human review. Automatic newsroom by Redazia.

Sources

Footnotes

1. The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, Google Cloud, 2026-11-02 ↩

2. Google finds ‘LLMjacking’ attackers running up $100K a day in fraudulent cloud charges, SiliconANGLE, 2026-11-02 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰