The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
B · Useful, limited First-hand incident-response reporting from Google's Mandiant and Threat Intelligence Group with named threat clusters, a CVE and indicators; credible, but it gives no incident count and the cost figures are single-case highs.
Summary based on the full text·Original: about 15 minutes to read
In short
A 2 November 2026 Google Cloud threat-intelligence post by Mandiant and the Google Threat Intelligence Group (GTIG) on "LLMJacking": criminals hijacking an organization's access to large language models and passing the bill to the victim. In 2026 incidents across finance, retail, technology and transport, charges ran above $100,000 in a day and up to $1 million in total. Stolen cloud identity tokens were the main way in. A resale market of "LLM Mixers" now pools stolen keys and sells cheap access.
Key numbers
- over $100,000fraudulent charges in a single day in individual incidents
- $1 millioncumulative charges at some organizations before access was revoked
- more than 500,000LLM API calls one actor ran in under eight hours to power the jet-night.com resale service
- about $60monthly price of Jet Night's unlimited token plan, against $100-$250 for comparable legitimate service
As reported by the source.
English·Web page·opens cloud.google.com
What it reports
- Incidents spanned North America, South America and Asia Pacific and several cloud and model providers; the number of incidents is not given.
- Charges exceeded $100,000 in a single day in individual incidents and reached $1 million cumulatively at some organizations before revocation.
- Main initial access: exposed or stolen cloud identity tokens (IAM credentials, service account keys, GitHub personal access tokens, session tokens). Other routes: publicly exposed endpoints such as Ollama, and LLM API keys harvested from public GitHub repositories.
- Attackers validated stolen keys with single-token requests (max_tokens=1) to stay below volume alerts.
- One cluster exploited a user-ID rebind flaw in the LiteLLM gateway (CVE-2026-40217) to turn ordinary virtual keys into proxy admin credentials.
- In several cases model services were not enabled at compromise; attackers enabled them (for example Bedrock or the Gemini API) and ran up bills in minutes or hours.
- One actor ran more than 500,000 API calls in under eight hours to supply jet-night.com, which passed nearly one million dollars in token costs to one victim and sells an unlimited plan for about $60 a month.
- Mitigation list: secrets management and rotation, least privilege that denies model services by default, secret scanning, spending caps and per-model quotas, phishing-resistant MFA, scoped API keys, patching model gateways, and monitoring native audit logs on AWS, Azure and GCP.
How they got it
Mandiant incident-response engagements in 2026 combined with GTIG tracking of underground markets. The post describes the attack lifecycle by stage with anonymised cases, names clusters (UNC6993) and infrastructure, and lists detection rules and audit-log operations to monitor.
Limits
- No incident count, victim count or distribution of losses; the dollar figures are the worst cases observed.
- Victims and providers are anonymised, so cases cannot be checked independently.
- Part of the detection guidance points to Google's own security products.
Why it matters for companies
Model API access is now a direct financial exposure: a leaked key can cost more in a day than many AI pilots cost in a year. Budget caps, per-model quotas and alerts on model service enablement are cheap controls that stop the worst bills. Keys should be scoped by model and environment, so a key for a basic model cannot call an expensive one. Model gateways such as LiteLLM belong in the same patching cycle as other production software, and data-access audit logs, often off by default, need to be switched on.
Summary based on the full text. Read the original for the full argument and data.Read the original on cloud.google.com