Google and Mandiant warn of LLMJacking with $1 million cloud bills

Google Threat Intelligence Group and Mandiant issued a warning on Nov. 2, 2026, saying criminals take over corporate cloud credentials to operate large language models at the expense of victims, with incidents in South America, North America and Asia Pacific.

Mandiant responded to multiple LLMJacking incidents during 2026. The incidents hit financial services, retail, technology and transportation firms. Some incidents saw fraudulent cloud charges rise above $100,000 in one day, while cumulative charges at certain organizations climbed to $1 million before access was cut off. LLMJacking can produce large spikes in fraudulent cloud charges within hours, unlike the gradual resource use tied to cryptojacking.

Stolen cloud identity tokens can include IAM credentials, service account keys, GitHub personal access tokens and active session tokens, and another group collected API keys from public GitHub repositories and checked them with single-token requests to avoid triggering alerts. Initial access vectors include valid LLM API keys and publicly exposed LLM endpoints. UNC6993 reached an AI API in mid-2026 after breaking into a cloud instance with a misconfigured service account key. UNC6993 set up a fake portal that tricked users into entering an active access token in a JSON payload, getting around passwords and multifactor authentication.

An attacker used CVE-2026-40217 in the LiteLLM /key/regenerate endpoint to elevate virtual keys to PROXY_ADMIN primary credentials. Attackers skip front-end chatbot interfaces to go after backend model resources directly.

Once inside, attackers look through code repositories and databases for more credentials. In one intrusion, an attacker checked cloud data warehouse metadata tables for sensitive columns, administrator passwords, and database credentials. Attackers set up backdoor accounts, including one posing as an internal billing optimization tool. In some incidents, attackers found AI services turned off at compromise and switched them on through stolen access keys; after that, a company can face a large AI bill within minutes or hours.

They said, “The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models,”. Operators that obtain initial access are separate from those who run LLM Mixers, which take unauthorized LLM access, combine it, and sell it to underground subscribers through proxying.

Jet Night sold an unlimited token plan for roughly $60 each month. Similar legitimate services run between $100 and $250 per month. GTIG assesses that Jet Night depends on stolen keys to stay profitable since its prices sit far below market rates.

A threat actor feeding Jet Night generated calls totaling more than 500,000 AI model requests in under eight hours, and the activity resulted in nearly $1 million in token costs for the victim organization. Jet Night posted about outages on Telegram, apparently because victims found the compromises and revoked keys, while an attacker used a lookalike domain to drain victim account quotas into the newapi.pro resale ecosystem.

UNC6993 attempted to create more API keys and activate services, quickly building over $100,000 USD in billing charges. Under a burn-and-rotate strategy, one threat actor watched billing impact and repeatedly created and deleted short-lived service accounts.

FortiGuard Labs traced a cloud intrusion involving a long-lived AWS IAM access key that carried AdministratorAccess permissions in research published Sept. 3, 2026. The attacker set up a new IAM user and signed up for foundation models through AWS Marketplace, issuing CreateAgreementRequest and AcceptAgreementRequest calls through the AWS Marketplace agreement service. Attackers additionally created Bedrock service-specific API keys for fresh identities to run inference calls through a less visible path.

Usage of premium Claude 2.x can cost victims over $46,000 per day, while Claude 3 Opus can go beyond $100,000 daily. Operation Bizarre Bazaar accounts for more than 35,000 attack sessions across more than 30 LLM providers, and stolen access is resold as bargain-priced AI chatbot subscriptions through Telegram and Discord. In reporting published Sept. 29, 2026, Sysdig’s Threat Research Team gave estimates of roughly $46,000 and more than $100,000 per day on top-tier models. Hultquist said illicit access offered models from Anthropic, Google, and OpenAI at up to 97% off.

Google expects criminals to favor LLMJacking over cryptojacking because resale lets them cash in quickly while victims pay. Infosecurity Magazine reported that LLMJacking is not new, though the ecosystem for it looks to be maturing. Criminals can obtain AI account credentials or API keys through corporate network compromise, phishing, breaches, unpatched flaws, or insider access.

Defenders should view any unauthorized enablement of LLM services as a critical security event. Google recommends short-lived role-assumed credentials rather than long-lived broad-scope IAM keys, and organizations should rely on centralized secrets management to control rotation of sensitive keys. Users and service accounts should receive only the permissions required for their role, with all other access denied, and automated secret scanning should spot and remove API keys added to source code.

API quotas and spending caps should restrict request volume and prevent over-spending, and organizations should enforce phishing-resistant multifactor authentication across cloud identity providers and developer platforms. Long-lived broad-scope IAM keys represent a top-tier risk because the attack chain can hinge on a single non-expiring administrator key. Google advises that teams turn on AWS CloudTrail and also enable Bedrock invocation logging for abuse detection. Bedrock invocation logging comes disabled by default; teams should enable it to capture request-level detail CloudTrail misses.