Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Ravie LakshmananNov 03, 2026Cloud Security / Artificial Intelligence Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code to gain unauthorized access to an organization's LLM accounts, while the legitimate owner covers the consumption costs. Such attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors. "Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News. "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked." On one end of the spectrum are low-level resource theft that involves the manipulation of customer support chatbots to conduct unauthorized tasks like code generation. LLMjacking is on the other end, as they target the backend model resources directly by identifying publicly exposed LLM endpoints or obtaining valid LLM API keys. The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens, which allow an attacker to establish an initial foothold into target organizations' infrastructure. This includes a threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key and used it to obtain access to an LLM API. "UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users," Google said. "This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multi-factor authentication (MFA) controls." In another case, an unknown attacker has been observed leveraging a stolen Personal Access Token to access private code repositories, following it up with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment. Other initial access routes include the compromise of IAM credentials of corporate users to programmatically generate fresh access keys to bypass MFA safeguards, as well as the use of a hacked cloud Service Account key with broad project permissions and LLM API keys obtained from public GitHub repositories. Upon successfully gaining a foothold, the threat actors waste no time escalating privileges, burrowing deeper into the network, establishing persistence, and conducting internal reconnaissance to identify targets and further cloud credentials for lateral movement. Some of the observed tactics are listed below - Enumerate cloud services, code repositories, and data stores for sensitive credentials. Perform internal reconnaissance across multiple cloud regions to map available services and identity policies. Clone sensitive codebases to search for hard-coded secrets, configuration variables, and developer credentials. Scan access logs to identify credentials for secondary cloud environments. Run targeted database queries to harvest additional credentials. Abuse cloud identity permissions and virtual machine configurations to escalate privileges and maintain persistent access. Exploit token-creation privileges associated with service accounts to generate temporary credentials for high-privilege service accounts and exfiltrate infrastructure credentials, internal database passwords, and third-party API keys from cloud secret managers. Create unauthorized IAM and service accounts and inject SSH keys into compute instances for persistence. Create backdoor service accounts disguised as internal billing optimization utilities. Exploit vulnerabilities targeting LLM routing software, such as CVE-2026-40217 in LiteLLM, to escalate privileges. "The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning," Google said. "Threat actors also leveraged their access to host their own proxy endpoints and agentic workloads." UNC6993, for instance, has created additional API keys to scale their operations within victim cloud projects, racking up over $100,000 USD in billing charges. Some threat actors attempt to bypass rate limits by adopting a "burn and rotate" strategy that involves continuously creating and deleting short-lived service accounts The maturation of the LLMjacking ecosystem has also paved the way for the emergence of a new category of actors called LLM Mixers, highlighting a division of labor between attackers who establish initial access and those who manage downstream monetization infrastructure. LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to other criminal actors via underground storefronts. One such service is Jet Night ("jet-night[.]com"), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month. By fueling an illicit resale marketplace, it permits bad actors to siphon enterprise quotas while passing the billing costs to victims before compromises are detected. Jet Night is far from the only token routing offering. According to a report published by Broadcom-owned Symantec and Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request through third-party infrastructure instead of the vendors' own servers. The service is assessed to be active since at least early 2026, primarily impacting a dozen organizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services. "Rather than building its own client software, the service repurposes the genuine CLI tools," Symantec said. "It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex's case by setting it to 'danger-full-access,' and routes every request through its own servers instead of OpenAI's or Anthropic's." The service appears to mainly target markets where Anthropic and OpenAI do not operate, with the installation driven by an employee attempting to try out a Western AI coding assistant by turning to an unauthorized reseller. Notably, the service does not distribute a modified or trojanized client. Shortly after the legitimate install of the Codex or Claude Code CLI through npm, users are likely instructed to run a one-line command to fetch fileless PowerShell or bash setup script from a lookalike domain ("vibe.aiok[.]me") that's used to override the configuration. The reconfiguration, which targets "~/.codex/config.toml" for Codex or "~/.claude/settings.json" for Claude Code, disables the CLI's execution sandbox, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting. The script also checks the Windows locale setting to confirm it's running on a system in the region it serves before the setup is completed. It's suspected that the operators behind the service are not only circumventing regional restrictions imposed by Western AI vendors, but are also reselling capacity below market rates similar to Jet Night. Although there is no evidence to suggest that the service is abusing its position to harvest prompts entered by employees or fabricate or alter responses, the findings demonstrate the security risks associated with using such tools. "Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers," Google said. "As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cloud security, Credential Theft, Cybercrime, Vulnerability China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens AI-Generated Fake Login Pages Are Making Account Takeovers Easier TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security