"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News.
LLMjacking: fast, high-cost resource theft
Google on Monday warned that attackers are adapting classic resource-hijacking tactics to the LLM era in an approach the company calls "LLMjacking." Unlike cryptojacking’s gradual drain, LLMjacking can produce large billing spikes in hours by abusing access to expensive models, GPUs, and downstream AI services. The activity spans North America, South America, and Asia Pacific and touches financial services, retail, technology, and transportation companies.
Primary entry points: exposed tokens, leaked keys, and misconfiguration
The most common initial access vectors are exposed or stolen cloud identity tokens: IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens. Those tokens let attackers establish a foothold in cloud environments and then programmatically generate fresh access keys to bypass multi-factor authentication controls, Google said. Attackers have also relied on public GitHub repositories that contain LLM API keys and on misconfigured service account keys with broad permissions.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTechniques observed after access: escalation, persistence, and token creation
Once inside, threat actors rapidly escalate privileges and map cloud resources. The report lists concrete tactics observed in intrusions, including:
- Enumerating cloud services, code repositories, and data stores for sensitive credentials.
- Cloning codebases to find hard-coded secrets and developer credentials.
- Scanning access logs and running targeted database queries to harvest additional tokens.
- Exploiting token-creation privileges to generate temporary high-privilege credentials and exfiltrate secrets from cloud secret managers.
- Creating unauthorized IAM and service accounts, injecting SSH keys, and deploying disguised backdoor service accounts.
The report also notes exploitation of an LLM routing vulnerability, CVE-2026-40217 in LiteLLM, as one path for privilege escalation and persistent abuse of model-routing middleware.
UNC6993: session hijacking and scale
Google describes a group it calls UNC6993 that used a misconfigured Service Account key to breach a cloud instance and obtain LLM API access. UNC6993 hosted a "session hijacking page masquerading as an application portal" that tricked users into pasting raw JSON payloads containing active access tokens; those tokens were then posted to backend APIs to bypass passwords and MFA, Google said. UNC6993 also created additional API keys inside victim projects to scale operations and racked up more than $100,000 in billing charges in at least one case.
LLM Mixers and Jet Night: a resale economy for stolen capacity
Google and other vendors report that LLMjacking has spawned a secondary market of "LLM Mixers" — illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access. One advertised service, Jet Night (jet-night[.]com), reportedly offers an unlimited token plan with access to a frontier model for roughly $60 per month. According to Google, these mixers let downstream criminal actors siphon enterprise quotas while the original victims pay the cloud bills until the compromise is detected.
Repurposed CLIs and a gray-market relay service (Symantec/Carbon Black)
A separate report from Broadcom-owned Symantec and Carbon Black described a gray-market relay service active since at least early 2026 that installs genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, then reconfigures them to route requests through third-party infrastructure. The service primarily affected organizations in Mainland China and subsidiaries in South Korea, Taiwan, and Malaysia across industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.
Symantec said the relay does not trojanize the client; rather, after a legitimate CLI install via npm, victims run a one-line command that fetches a fileless PowerShell or bash setup script from a lookalike domain ("vibe.aiok[.]me"). That script disables sandboxing, enables network access for the write sandbox, replaces a user's real API credentials with relay-issued tokens, and disables telemetry and error reporting — effectively routing enterprise traffic through the reseller's servers.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Expect automated reconnaissance to increasingly target exposed API tokens and model-routing middleware; observed tactics include creating short-lived service accounts in a "burn and rotate" pattern and exploiting routing vulnerabilities such as CVE-2026-40217.
- Procurement and IT leaders: The emergence of LLM Mixers like Jet Night and relay services that reconfigure genuine CLIs illustrates a resale market that can bypass vendor distribution channels and regional restrictions — procurement controls and verified vendor channels will affect exposure.
- End users and developers: Scripts and one-line install flows that fetch remote setup scripts (for example from "vibe.aiok[.]me") were used to override local CLI configurations and replace credentials; caution is warranted when following informal setup instructions for tooling sourced outside official vendor channels.
Google summed up the shift bluntly: "Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers." As organizations move higher-tier models and agentic workflows into production, the report warns, attackers will refine automated reconnaissance and exploit weaknesses in routing middleware and token handling — producing fast, visible cost impacts and a new resale economy for stolen model access.
