"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1m before access was revoked," Google's Mandiant business warned in a briefing this year.
How Mandiant defines LLMJacking
Mandiant calls the practice "LLMJacking": an attack pattern in which threat actors bypass front-end chatbots and target backend model resources to monetize and hijack foundation models. The company said the technique is not new but that the ecosystem enabling it is maturing. From an initial foothold, attackers escalate privileges, perform internal reconnaissance, and hunt for additional cloud credentials and targets inside victim environments.
Specific attack vectors: exposed API keys and cloud identity tokens
Mandiant detailed the access methods adversaries exploit. The most frequently abused items are LLM API keys and exposed or stolen cloud identity tokens, specifically including:
- IAM credentials
- Service Account keys
- GitHub Personal Access Tokens
- Active session tokens
Beyond credential theft and escalation, Mandiant noted that attackers may also target vulnerabilities in LLM routing software to further escalate privileges and widen access to model compute resources.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageFinancial impact: rapid, large spikes in cloud bills
Unlike cryptojacking — which Mandiant describes as gradual resource consumption — LLMJacking can produce large spikes in fraudulent cloud charges "in a matter of hours." The incidents Mandiant investigated this year included single‑day fraudulent charges in excess of $100,000, with some organizations accumulating roughly $1,000,000 in charges before their access was revoked.
Those figures underline the immediacy of the risk: attackers can exhaust enterprise model quotas and drive high GPU and model‑streaming costs quickly enough that billing becomes an early and visible symptom of compromise.
LLM Mixers and an emerging illicit resale marketplace
Mandiant reported a developing "division of labor" among financially motivated cybercrime clusters across North America, South America and Asia Pacific. Some groups specialize in initial access, while others — described as "LLM Mixers" — handle downstream monetization.
These LLM Mixers operate routing gateways that "proxy, aggregate and resell" access to models. The ultimate monetization approaches Mandiant identified include token proxying, automated model streaming and GPU hardware provisioning. Google warned that this operational specialization enables threat actors to rapidly siphon enterprise quotas while the billing costs are passed to victims before compromises are detected.
What this means for technologists, enterprise security teams, and procurement
- Technologists and security teams: Mandiant says attackers will refine automated reconnaissance to hunt exposed API tokens and exploit vulnerabilities in model routing middleware as organizations integrate higher‑tier models and agentic workflows into production. Teams will need to assume that stolen tokens and routing middleware weaknesses are prime targets.
- Enterprise security and incident responders: The pattern observed — high single‑day charges and seven‑figure cumulative bills before revocation — suggests detection and containment windows can be short. Responders will see financial telemetry (spiking cloud bills, abnormal GPU provisioning) emerge as an early indicator of LLMJacking.
- Procurement and platform owners: The emergence of routing gateways and resale markets ("LLM Mixers") means third‑party access pathways can be monetized by criminals lurking downstream; organizations should expect that attackers may pass billing to the original subscription holder rapidly.
Google's Mandiant concludes that as enterprise use of larger models and agentic workflows grows, LLMJacking is likely to attract more attention from cybercriminals and could eclipse cryptojacking as a preferred monetization strategy. The data Mandiant cites — six‑figure single‑day charges and up to $1 million before access revocation — poses a clear, immediate cost to enterprises and a structural challenge for cloud and model security.
