Cybercriminals are executing LLMjacking attacks against enterprise cloud accounts to steal artificial intelligence processing capacity, racking up bills exceeding $100,000 in a single day, Google researchers reported on Monday. The compromises have left some victims with aggregate losses reaching $1 million before security teams revoked access.
Key points
- Attackers hijack cloud identity tokens and open endpoints to run expensive queries on enterprise accounts.
- Illicit cloud charges from model hijacking can spike past $100,000 within hours, far faster than traditional cryptojacking.
- Brokers funnel stolen access through illicit proxy networks called LLM mixers, selling unlimited frontier model access for $60 a month.
- Security teams are urged to monitor single-token test queries and restrict automatic provisioning of model services.
The findings come from Google’s threat intelligence research published jointly by Mandiant and the Google Threat Intelligence Group. Investigators tracked multiple intrusions across 2026 where attackers targeted high-end large language models hosted in cloud environments.
Victims identified in the report span North America, South America and the Asia-Pacific region. Target organisations included businesses in financial services, retail, technology and transportation. In several incidents, the total financial damage accumulated to seven figures before defenders isolated the intrusions.
How attackers infiltrate enterprise models
Unlike cryptojacking, which gradually drains processor power to mine cryptocurrency over weeks, LLMjacking consumes massive amounts of expensive specialised hardware in hours. Premium models deployed on cloud infrastructure incur immediate per-token charges that scale rapidly under sustained traffic.
Threat groups gained access primarily by exploiting exposed or stolen identity credentials. Investigators found that service account keys, GitHub personal access tokens and unsecured model endpoints, including exposed Ollama servers, served as primary entry points.
In one campaign, an intrusion cluster tracked as UNC6993 used a misconfigured service account key to access an internal model application programming interface. The group set up a fraudulent portal masquerading as a registration site for an enterprise tool.
Visitors were redirected to an authentic model provider and instructed to copy a raw JSON authentication payload back to the attacker’s page. The captured active session tokens allowed the group to bypass passwords and multi-factor authentication entirely.
Other actors gathered credentials by automated scanning. One group scraped public GitHub repositories for API keys and validated each credential by submitting a prompt capped at a single output token. These micro-requests deliberately slipped beneath standard anomaly thresholds in enterprise security tools.
The rise of LLM mixers and token resale
Google noted an emerging division of labour between groups that compromise cloud accounts and third-party brokers who monetise the access. Stolen credentials frequently feed into underground relays known as LLM mixers.
Mixers function as reverse proxies, combining open-source API gateways and custom code to obscure the origin of incoming prompts while metering bandwidth. Operators run tools such as new-api and gcli2api to manage traffic across dozens of hijacked enterprise keys.
One service, operating under the name Jet Night, offered subscribers unlimited access to proprietary frontier models for roughly $60 a month. Legitimate enterprise and consumer subscriptions for equivalent model tiers typically cost between $100 and $250 monthly.
Google linked Jet Night to a breach where an attacker made more than 500,000 API calls through a victim organisation’s account in less than eight hours. The targeted company faced nearly $1 million in model costs. Periodic service interruptions announced on the mixer’s Telegram channel corresponded directly to victims identifying the breach and revoking their API credentials.
Vulnerabilities in model routing gateways
Attackers also targeted intermediary infrastructure used to connect applications to foundational models. In one documented intrusion, a secondary group acquired valid virtual keys and targeted the victim’s LiteLLM proxy gateway.
The actors exploited a vulnerability catalogued as CVE-2026-40217, an identity rebind bug inside the key regeneration endpoint. The exploit elevated standard virtual keys into master administrator credentials, granting full control over the gateway routing rules.
To bypass rate limits and spending throttles, attackers implemented automated provisioning techniques. One group used a burn-and-rotate method, creating and deleting short-lived service accounts across corporate cloud projects. Another deployed a containerised backdoor running the Manus agent framework, prompting an upstream model to plan multi-step system actions and run malicious code on the host.
As enterprises scale their external compute dependencies, such operational strains echo broader industry pressures. While infrastructure projects like orbital data centres and massive enterprise expansions show how valuable compute has become, loose access controls leave corporate accounts vulnerable to rapid resource drainage. Many businesses are also turning to hybrid providers, such as when Oracle expands cloud compute setups with diverse chip architectures, creating sprawling environments that require strict identity management.
Defending enterprise cloud infrastructure
Google’s incident response teams discovered that several victim organisations had never deliberately configured machine learning tools. Attackers used stolen administrative permissions to activate services such as Google’s Gemini API and Amazon Bedrock, initiating billing on dormant accounts.
Mandiant recommended that organisations treat the unapproved activation of machine learning services as a critical security incident. Recommended defensive measures include hard spending limits at the cloud billing account level, restricting API keys to specific models, and auditing logs for single-token validation requests.
John Hultquist, chief analyst at Google Threat Intelligence Group, warned that illicit demand for autonomous capabilities will drive further targeting of enterprise accounts.
“Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks,” Hultquist said.
Google expects financial threat actors to expand automated targeting against model gateways and routing middleware as more businesses deploy autonomous agent pipelines into operational environments.
