More than $100,000 in a single day and, in some cases, accumulated charges of up to one million: that is the cost Google and Mandiant attribute to attacks hijacking enterprise artificial intelligence infrastructure. The technique, known as LLMjacking, exploits stolen or exposed credentials to generate usage on cloud services that the affected organization continues to pay for.
On November 2, Google Threat Intelligence Group (GTIG) published an analysis of several intrusions investigated by Mandiant during 2026. The cases span different cloud and language-model providers and affected organizations in North America, South America, and Asia-Pacific across the financial, retail, technology, and transportation sectors. BleepingComputer, The Hacker News, CSO Online, and CRN Asia reported on the findings.
The operation does not necessarily involve stealing data or manipulating a chatbot visible to the public. Attackers seek direct access to the victim’s model and computing resources, then use them or turn them into a service for third parties. In practice, the requests appear to be legitimate usage associated with the compromised accounts; however, the bill goes to the company whose access was hijacked.
From a stolen credential to a seven-figure bill
GTIG observed two types of initial access: searching for publicly exposed model endpoints and stealing valid API keys from unprotected machines or environments. The most common method in the investigations was the use of exposed or stolen cloud identity tokens. These included Identity and Access Management (IAM) credentials, service account keys, GitHub personal tokens, and active session tokens.
Model API keys published in public GitHub repositories were also found. One group tested them using automated requests that generated a single token, with the max_tokens=1 parameter. The test confirmed that a key worked without generating the volume of traffic that would normally attract the attention of detection systems. CSO Online noted that these microtransactions can fall below consumption-based alert thresholds.
In another case, an unknown actor used a stolen Personal Access Token to access private code repositories and then exploited a suspected vulnerability in an application packaged within a containerized cloud environment. Google also described the use of corporate IAM credentials to generate new access keys and the abuse of service account keys with broad permissions.
Initial access can open the door to a broader search within the infrastructure. Attackers enumerated cloud services, repositories, and data stores; reviewed access logs; cloned code to locate embedded secrets and developer credentials; and queried databases to obtain passwords and other access data. In one intrusion, the exploration covered several cloud regions.
To maintain control, some actors created unauthorized IAM or service accounts, modified permissions, and injected SSH keys into virtual machines. Google also recorded backdoor accounts disguised as internal billing optimization tools and the use of token-creation permissions to obtain temporary credentials for more privileged accounts. In one case, this process enabled the extraction from secrets managers of infrastructure credentials, internal database passwords, and third-party API keys.
UNC6993, a fake page, and a breach in LiteLLM
One of the groups identified by Google is UNC6993. In mid-2026, according to GTIG’s analysis, it compromised a cloud instance using a misconfigured service account key and used that access to gain entry to an LLM API. The group also created a session-hijacking page that imitated an application portal.
The page directed users to the legitimate LLM service website and asked them to paste a JSON block containing an active access token. The token was then sent to a backend API to bypass the password and multifactor authentication (MFA). Google described this as a way to steal an already authenticated session without relying solely on capturing a password.
The intrusions were not limited to credentials. Investigators observed exploitation of CVE-2026-40217, a vulnerability in LiteLLM, software for routing requests between applications and models. Google’s analysis places the flaw in the /key/regenerate endpoint: an actor exploited a user ID reassignment vulnerability to turn standard virtual keys into PROXY_ADMIN administrative credentials.
CRN Asia describes the result as an escalation from ordinary virtual keys to administrator permissions. Google said that, in this investigation, a second group obtained virtual keys previously validated by the actor who had gained initial access, and then attacked the application logic. This division of tasks shows that intrusions can combine the initial compromise of an account with the subsequent takeover of the model gateway.
Intermediaries resell access to models
The downstream business is organized around so-called LLM Mixers: routing gateways that pool compromised credentials, distribute requests across accounts, and resell access to underground subscribers. Operators can place their own infrastructure in between to hide the origin of requests and turn stolen enterprise quotas into a paid service.
Google identified Jet Night as one such service. In one case, an actor made more than 500,000 calls to LLM APIs in less than eight hours using stolen third-party API keys to power Jet Night’s request routing. The usage shifted nearly one million dollars in token costs to the victim organization.
Jet Night offered an unlimited token plan for approximately $60 per month, with advertised access to advanced models. Google compared this price with the typical monthly cost of $100 to $250 for similar consumer services. The low price attracts subscribers, while the actual expense is charged to the accounts of compromised companies.
GTIG also observed Jet Night announcing several outages on its public Telegram channel. Google considers it likely that some were related to the revocation of stolen keys after victims discovered the unauthorized access. The infrastructure depends on credentials remaining active: when a company invalidates them, the service loses some of the capacity it was reselling.
UNC6993, meanwhile, reportedly used open-source tools such as new-api and gcli2api to pool keys and distribute requests across accounts. GTIG believes the group sells access to these tools through underground stores. In another case, custom relay infrastructure hosted on domains imitating a victim’s internal systems diverted commercial model quotas to the newapi[.]pro resale ecosystem.
Fraudulent use can also go beyond model calls. Investigators saw actors activate AI services that had not been enabled before the intrusion, generate additional keys, and sign up for pay-as-you-go plans with premium models. To bypass request limits, some used a “burn and rotate” strategy: repeatedly creating and deleting short-lived service accounts while monitoring the billing interface.
In one case, an actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy packages to offer endpoints compatible with several advanced models under the identity D1337-KAIROS. Google also documented a backdoor based on the Manus agent framework, which queried a model to interpret instructions and execute commands in the compromised environment. The actor went so far as to provision cloud instances with GPUs, attempted to deploy high-end hardware in several regions, and requested quota increases through the provider’s API.
What Google recommends and what it expects from attackers
Google recommends starting with IAM and supply chain security. Its measures include centralizing secrets management and rotation, avoiding privileges that are not necessary for each role, and denying by default any permissions that have not been explicitly required, including access to cloud LLM services.
The company also advises using phishing-resistant MFA, monitoring for unauthorized activation of AI services, and setting usage and spending limits for APIs. Cloud and inference audit logs should be enabled and reviewed to detect unexpected activations, suspicious credential checks, unusual consumption patterns, and attempts to disable logging.
The monitoring recommendation matters even before a striking bill appears. Key tests using single-token requests can go unnoticed if only large volumes are monitored. Google proposes gaining visibility into unauthorized AI and model services—so-called shadow AI—and treating any activation of services the organization has not authorized as a serious incident.
Google’s findings point to an expansion of the resale model. GTIG expects attackers to prioritize LLMjacking over traditional forms of resource theft, such as cryptojacking, because access can be monetized quickly through LLM Mixers. It also expects them to improve automated scanning for exposed tokens and to seek vulnerabilities in routing middleware as companies adopt more capable models and agentic workflows.
“Organizations will need to closely monitor and secure the models and computing resources they are rapidly bringing online, or they may not be the only ones using them. That means examining usage, enabling multifactor authentication, and carefully managing secrets.”
— John Hultquist, Chief Analyst, Google Threat Intelligence Group
In the incidents analyzed, some organizations accumulated charges of up to one million dollars before revoking the compromised access. Google recommends monitoring credentials as well as service activation, permission changes, and API usage to detect abuse before costs continue to rise.
Sources: BleepingComputer, The Hacker News, Google Cloud Blog, CSO Online, CRN Asia
