Cybercriminals are hijacking corporate access to artificial intelligence systems and running up fraudulent cloud bills exceeding $100,000 in a single day, with some organizations seeing cumulative charges reach $1 million before detecting the breach, according to a report released Monday by Google Threat Intelligence Group and Mandiant. The practice, dubbed LLMjacking, involves attackers stealing API keys through phishing, code leaks, or misconfigured systems to gain unauthorized access to enterprise large language model accounts while victims foot the bill. The attacks have struck entities across North America, South America, and Asia Pacific, targeting financial services, retail, technology, and transportation companies.
Threat actors most commonly gain initial access by obtaining exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens, the report finds. One group, identified as UNC6993, breached a cloud instance through a misconfigured Service Account key and later hosted a fake application portal that tricked users into pasting raw JSON payloads containing active access tokens, bypassing password and multi-factor authentication controls. In another case, an unknown attacker leveraged a stolen Personal Access Token to reach private code repositories before exploiting a suspected web application vulnerability in a containerized cloud environment. Once inside, attackers escalate privileges by enumerating cloud services for sensitive credentials, cloning codebases to search for hard-coded secrets, scanning access logs for secondary environment credentials, and running database queries to harvest additional keys. They maintain persistence by creating unauthorized IAM and service accounts disguised as internal billing utilities, injecting SSH keys into compute instances, and exploiting vulnerabilities like CVE-2026-40217 in LiteLLM routing software.
"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google stated. The attackers monetize their access through token proxying, automated model streaming, and GPU hardware provisioning, with UNC6993 creating additional API keys to scale operations and generating over $100,000 in billing charges. Some threat actors bypass rate limits using a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts. The ecosystem has matured enough to spawn LLM Mixers, illicit routing gateways that proxy, aggregate, and resell unauthorized access to other criminals via underground storefronts. One service, Jet Night, offers an unlimited token plan with alleged frontier model access for approximately $60 per month, siphoning enterprise quotas while victims cover costs.
The report warns that threat actors will increasingly prioritize LLMjacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground resale markets. As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware. A separate Symantec report last week identified a grey market relay service active since early 2026 that installs genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, then reconfigures them to route every request through third-party infrastructure instead of vendor servers, primarily impacting organizations in Mainland China and multi-national subsidiaries across South Korea, Taiwan, and Malaysia. The convergence of high-value AI infrastructure and lax credential management creates an expanding attack surface that organizations have yet to adequately defend. Enterprises integrating generative models must now treat API keys with the same rigor as financial credentials, or risk subsidizing an entire shadow economy built on stolen compute.