LLMJacking attacks leave companies with up to US$1 million in cloud charges

Google finds LLMJacking attacks using stolen AI credentials resulted in up to US$1 million in fraudulent cloud charges.

Cybercriminals are exploiting compromised enterprise AI infrastructure to generate fraudulent cloud charges, with cumulative charges at some affected organizations reaching US$1 million before access was revoked.

According to research published by Google Threat Intelligence Group (GTIG) and Mandiant, the attacks involve a technique known as LLMJacking, in which threat actors hijack access to LLMs and cloud computing resources. Mandiant investigated multiple incidents in 2026, including cases where fraudulent charges exceeded US$100,000 in a single day.

The incidents affected organizations in North America, South America, and Asia-Pacific across the financial services, retail, technology, and transportation sectors. The investigations covered several cloud and LLM providers, rather than a single platform.

How attackers exploit enterprise AI infrastructure

The investigations found that stolen or exposed cloud credentials were the main entry point for attackers. These included identity and access management (IAM) credentials, service account keys, GitHub personal access tokens, and active session tokens.

In one incident, a threat group tracked as UNC6993 exploited a misconfigured service account key to compromise a cloud instance and gain access to an LLM API. The group also created a fraudulent application portal that tricked users into submitting active access tokens from a legitimate LLM service, allowing the attackers to bypass password and multifactor authentication protections.

Other attackers collected exposed corporate LLM API keys from public GitHub repositories. One group tested the stolen credentials using automated requests that generated just a single token, allowing it to verify access without triggering the victims' security alerts for unusual request volumes.

Once inside the affected environments, attackers searched code repositories, cloud services, and databases for additional credentials. Some created unauthorized administrative accounts, modified access permissions, and inserted SSH keys into virtual machines to maintain access.

Mandiant also documented an incident involving a user ID rebind vulnerability in LiteLLM, software used to route requests between applications and AI models. Attackers exploited the vulnerability, tracked as CVE-2026-40217, in the software's /key/regenerate endpoint to elevate standard virtual keys to administrator-level credentials.

How stolen AI access generates revenue for cybercriminals

The attackers used compromised cloud accounts to access paid AI models, generate large volumes of API requests, and provision computing resources. In some cases, they enabled AI services that had not previously been activated within the victim's cloud environment.

UNC6993 attempted to create additional API keys and activate services within compromised cloud projects. In another incident, an attacker subscribed victim accounts to pay-as-you-go services and generated high volumes of requests using premium AI models.

To work around rate limits, the attackers repeatedly created and deleted temporary service accounts. They also monitored cloud billing interfaces while consuming the compromised resources.

The attacks extended beyond AI model APIs. In one incident, an attacker provisioned GPU-equipped cloud instances, attempted to deploy additional computing resources across multiple regions, and requested quota increases through the cloud provider's API.

The attacker also deployed a backdoor using the Manus AI agent framework to execute commands within the compromised environment. Separate LiteLLM gateways were hosted on external servers to manage and route API traffic.

GTIG found that some groups were selling unauthorized AI model access through services known as LLM Mixers. These platforms combine stolen credentials and route requests through compromised accounts, allowing paying customers to use AI models while the affected organizations incur the charges.

The researchers also identified separate criminal groups coordinating their activities. In one investigation, one group established initial access, while another obtained the stolen credentials and exploited a LiteLLM vulnerability to gain administrative control of the compromised environment.

In one case, an attacker made more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys. The activity supported a token-routing service called Jet Night and passed nearly US$1 million in usage costs to the victim organization.

According to GTIG, Jet Night advertised unlimited token access for approximately US$60 per month, with claimed access to advanced AI models. The researchers compared this with similar consumer AI services typically costing US$100 to US$250 per month.

Jet Night also advertised multiple service outages on its public Telegram channel. GTIG assessed that these disruptions were likely linked to stolen API keys being revoked after affected organizations discovered the compromises.

In another case, an attacker used proxy infrastructure hosted on domains resembling a victim's legitimate systems to redirect commercial AI model access to an illicit resale service. The activity consumed the victim organization's available API quota to serve unauthorized customers.

Google's researchers recommended restricting cloud permissions, rotating exposed credentials, and scanning code repositories for API keys. They also advised organizations to set quotas and spending limits for individual AI models.

Additional recommendations include identifying unauthorized AI models and services across cloud environments, restricting API keys to specific models and usage limits, and monitoring low-volume requests used to validate stolen credentials. The report also advised organizations to include AI model gateways such as LiteLLM in their vulnerability management programs.

John Hultquist, Chief Analyst at Google Threat Intelligence Group, said organizations need to monitor the AI infrastructure they deploy to prevent unauthorized use.

"Organizations will have to closely monitor and secure the models and compute they are rapidly bringing online or they may not be the only ones using them. That means scrutinizing usage, enabling multifactor authentication, and carefully managing secrets," Hultquist said.