Unauthorized access to corporate large language models, a technique called LLMJacking, is being used to resell AI services and generate massive cloud bills for victims. Google Threat Intelligence Group (GTIG) reported on November 2 that these attacks have affected various industries across North America, South America, and Asia Pacific, leading to costs reaching $1 million.
Financial impact on victim organizations
Mandiant investigated multiple 2026 incidents where stolen credentials resulted in more than $100,000 in charges during a single day. These operations focus on hijacking paid AI model access rather than stealing computing power to mine cryptocurrency. The targeted organizations operate in the financial services, retail, technology, and transportation sectors. Unlike traditional cryptojacking, the financial loss stems from the rapid generation of high volume AI usage fees.
Stolen credentials and stealthy validation
Exposed or stolen cloud credentials serve as the primary entry point for these operations. This includes service account keys, GitHub personal access tokens, and active session tokens. Attackers also harvest corporate LLM API keys from public GitHub repositories. Similar paths to unauthorized model use have been observed through leaked AWS keys.
To avoid triggering security alerts, groups perform low volume tests to confirm if the keys are valid before starting larger abuse. One tactic involves sending tiny requests with a max_tokens=1 setting. These tests stay below the typical security alert thresholds used by victims. One group, UNC6993, reached cloud resources by using a misconfigured service account key. This group also ran a fake membership portal designed to trick users into pasting session data that included active access tokens. Reusing these tokens allowed the intruders to bypass password and multifactor authentication requirements.
Resale through token routing services
Stolen access is often fed into LLM Mixers, which are routing services that sell unauthorized model access to paying subscribers. While the operators collect revenue, the victim organization receives the bill. One organization incurred nearly $1 million in costs due to a token routing service called Jet Night. In that specific incident, an intruder utilized stolen third party keys to execute over 500,000 LLM API calls within an eight hour window. GTIG suggests that the unusually low prices of these routing plans are made possible by the use of stolen credentials.
Persistent access and gateway exploitation
Intruders have been observed searching private repositories, secret managers, and databases for additional keys and passwords. The investigation into these operations has not established a link to the Northflank security incident, though the risks regarding secret managers are similar. Some attackers created administrator accounts or added SSH keys, while others hid backdoor service accounts by naming them as billing tools.
Exploitation of gateway flaws also provides lasting control. Mandiant reported that attackers exploited CVE-2026-40217, a flaw in LiteLLM involving the /key/regenerate endpoint. This allowed ordinary virtual keys to gain PROXY_ADMIN privileges.
Defensive monitoring and secret management
Google Threat Intelligence Group advises organizations to treat any unexpected activation of AI services as a serious warning. This is especially true for companies that had not previously enabled LLM features. Security teams should monitor for new access keys, rapid account creation or deletion, unusual model requests, and attempts to disable logging.
Organizations should rotate exposed secrets, restrict permissions, and scan repositories for keys. It is also necessary to patch gateways and enforce specific model quotas. Monitoring must specifically look for tiny validation requests rather than just large spikes in spending. Revoking the first stolen key is insufficient if attackers have already created replacement accounts or other persistent access points.
Licensed under CC BY-ND 4.0 International