Google’s Threat Intelligence Group (GTIG) and Mandiant have warned that criminals are hijacking enterprise access to large language models and reselling it, leaving some victims with cloud bills of up to $1 million. The tactic, which Google calls LLMjacking, produced fraudulent charges of more than $100,000 in a single day in individual incidents the team investigated in 2026.

“Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours,” Google wrote in its report, published November 2. Mandiant responded to multiple incidents across financial services, retail, technology and transportation, affecting organizations in North America, South America and Asia Pacific.

Code used by a threat actor to test publicly exposed Ollama endpoints and register its own models
Google’s report shows how threat actors probe publicly exposed LLM endpoints and register their own models on them. Image: Google Threat Intelligence Group.

How the Attacks Work

The most common way in is not the AI model itself, but ordinary cloud credentials. Attackers used exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens and active session tokens, to establish a foothold. In one case, a cluster Google tracks as UNC6993 compromised a cloud instance in mid-2026 through a misconfigured service account key and used that access to reach an LLM API.

UNC6993 also ran a session hijacking page that pretended to be an application portal for a group of LLM users. The page tricked visitors into pasting a raw JSON payload containing an active access token, bypassing password and multifactor authentication controls. Other attackers harvested exposed corporate LLM API keys from public GitHub repositories, then validated the stolen keys with minimal single token requests to stay under detection thresholds.

Once inside, attackers escalated privileges, created unauthorized accounts and injected SSH keys. In one intrusion, a follow-on group exploited a vulnerability in the LiteLLM gateway, CVE-2026-40217, to elevate standard virtual keys into full PROXY_ADMIN master credentials, giving it deep control of the victim’s environment.

The Resale Business

What makes LLMjacking different from older cloud theft is the business model. Instead of using the stolen access themselves, criminals feed it into what GTIG calls LLM Mixers, illicit routing gateways that proxy, aggregate and resell unauthorized LLM access to underground subscribers.

The clearest example in the report is a service called Jet Night. It offers an unlimited token plan for about $60 a month with claimed access to frontier models, a level of service that would typically cost between $100 and $250 a month. In one case, an actor using stolen third-party API keys made more than 500,000 LLM API calls in under eight hours to power the service, passing nearly $1 million in token costs to the victim organization. “Given Jet Night’s per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably,” Google wrote.

Screenshot of the Jet Night service pricing page showing plans from 99 to 4,990 rubles
A screenshot from Google’s report shows the Jet Night service selling access to frontier models at prices far below market rates. Image: Google Threat Intelligence Group.

Attackers also enabled managed generative platforms on victim accounts, subscribed them to pay-as-you-go agreements with premium models, and ran high volume inference streams. To dodge rate limits, one group used a “burn and rotate” strategy, continuously creating and deleting short lived service accounts while watching the provider’s billing interface to track the financial impact.

Why It Matters

GTIG expects threat actors to increasingly prioritize LLMjacking over traditional resource theft like cryptojacking, driven by the immediate, high margin monetization the underground mixers enable. As enterprises put higher tier models and agentic workflows into production, the report warns, criminals will refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing software.

“Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks,” John Hultquist, chief analyst at GTIG, told The Register.

Google’s main defensive advice is to treat any unexpected activation of AI services as a critical security event. In several incidents Mandiant investigated, LLM services were not even enabled at the time of compromise, and the attackers switched them on themselves. Billing alerts, spending caps on AI services, tightly scoped keys and monitoring for sudden spikes in model use are the practical defenses.

Sources