Cybercriminals are increasingly targeting corporate access to large language models.
This is the finding of Mandiant, Google’s incident-response subsidiary, which was called upon repeatedly in 2026 for intrusions of this kind. The phenomenon already has a name: the “LLMJacking.”
Attacks are not limited to a single cloud provider or model vendor but affect several of them. Spanning North America, South America, and the Asia-Pacific region, victims come from sectors as varied as finance, retail, technology, and transportation.
Unlike cryptojacking, which drains the victim’s resources gradually, LLMJacking triggers billing surges within a few hours.
Investigators recorded fraudulent charges of more than $100,000 in a single day. In some organizations, the total rose to $1 million before access was revoked.
The Google Threat Intelligence Group (GTIG) also identifies several financially motivated groups spread across different regions. It also notes a division of labor: some actors secure the initial access to the compromised environments.
Other actors monetize through infrastructures dubbed “LLM Mixers.” These illicit routing gateways relay, aggregate, and resell unauthorized access to subscribers in the clandestine market.
Cloud credentials as entry points
Attackers do not go through public-facing interfaces; they directly target the model resources behind the scenes, seeking publicly exposed LLM endpoints or valid API keys.
In one case, an automated script tested Ollama endpoints left open in order to register its own models there.
Nevertheless, the dominant vector remains the theft or exposure of ID Tokens, IAM credentials, service account keys, GitHub Personal Access Tokens (PATs), and session tokens.
Several scenarios have been documented:
- UNC6993 compromised a cloud instance via a misconfigured service account key. This group also hosted a fake application portal page. It invited users to paste the raw JSON content of an active access token, which allowed them to bypass passwords and multi-factor authentication.
- Another actor combined a stolen PAT, granting access to private code repositories, with the exploitation of a suspected vulnerability in a container.
- A third used employees’ IAM credentials and federation tokens to generate new access keys, bypassing the MFA requirement.
- One actor retrieved enterprise LLM API keys exposed in public GitHub repositories. They tested them with single-token requests (max_tokens=1), enabling them to validate their viability without triggering volume alerts from the victim’s EDR and SIEM tools.
Privilege escalation and persistence
Once inside, the attackers map services, identity policies, and code repositories. They search for secrets embedded in code, configuration variables, and other credentials. They also targeted the metadata of a cloud data warehouse, hunting for database passwords.
To establish a durable foothold, the intruders created unauthorized IAM and service accounts, sometimes masquerading as internal billing-optimization tools. They also injected SSH keys into compute instances. One actor abused token-creation privileges to obtain temporary credentials for highly privileged accounts, enabling the exfiltration of secrets from the cloud’s secret managers.
The GTIG also flags the exploitation of a flaw in a LLM routing software.
A second group, after obtaining validated virtual keys already vetted by the initial access actor, attacked the victim’s LiteLLM gateway. It exploited a user-identity reallocation vulnerability on the /key/regenerate endpoint (CVE-2026-40217). Standard virtual keys thus became full administrative identifiers (PROXY_ADMIN).
How access is monetized
The attackers spin up generative AI platforms, create additional keys, and launch massive inference workloads.
UNC6993 thus accrued more than $100,000 in billing. Another actor subscribed to consumption-based plans on premium models. To bypass rate limits, they employed a “burn and rotate” strategy — continually creating and deleting ephemeral service accounts while monitoring the financial impact via the billing interface.
Some operators host their own proxies and agent workloads.
One actor deployed public reverse proxies exposing cutting-edge models under a single identity, “D1337-KAIROS.” They also set up a containerized backdoor based on the Manus agent framework. This agent queried an LLM to reason about instructions and execute commands locally. The same actor provisioned machines equipped with powerful GPUs across multiple regions and requested quota increases through the provider’s API.
The resale happens via the “LLM Mixers.” UNC6993 used open-source tools (new-api and gcli2api), likely to collate stolen keys and distribute the load across accounts. The GTIG suspects the actor sells access to these tools through clandestine marketplaces.
The case of Jet Night (jet-night.com) is detailed.
One actor carried out more than 500,000 API calls in under eight hours using stolen third-party keys to feed this token-routing service. The bill, nearing one million dollars, was charged to the victim organization.
LLMJacking is set to outrun cryptojacking
The service offers an “unlimited” plan of around $60 per month with presumed access to cutting-edge models, while a comparable consumer service would cost between $100 and $250.
For the GTIG, the profitability of Jet Night appears to rest on stolen keys. The service has reported several outages on its public Telegram channel, likely linked to victims revoking keys.
Another actor used a relays infrastructure (ai-relay) hosted on domains mimicking the victim’s, to feed the resurgence ecosystem newapi[.]pro with the victim’s quotas.
The GTIG anticipates that LLMJacking will surpass cryptojacking thanks to immediate, high-margin monetization.
The integration of premium models and production-grade agent workflows is expected to amplify the phenomenon. Attackers are likely to refine automated recognition of exposed API tokens and to exploit weaknesses in model routing middleware.
On the detection front, Mandiant notes that in several incidents the LLM services were not activated at the time of compromise. The hijacked keys were used to activate them (Bedrock, API Gemini, etc.). Any unauthorized activation should therefore be treated as a critical security incident.
