"Based on their observations, there are 'two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure,'" researchers from Google's Threat Intelligence Group (GTIG) and Mandiant concluded — and the bill for some victims has already climbed into seven figures.
How attackers turn stolen LLM access into cash
GTIG and Mandiant traced two broad workflows. In one, operators scan for publicly exposed LLM endpoints and take advantage of misconfigurations. In the other, they search compromised environments for valid API keys and other credentials — then sell that access. Both pathways end the same way: unauthorized API calls are routed through legitimate customer accounts and recorded as normal consumption, generating large token charges for the victim organization.
The teams documented sudden spikes in request volume after access is resold. In multiple incidents request rates exceeded 1,000 requests per second. The researchers reported fraudulent charges topping $100,000 in a single day, and cumulative charges at some organizations reaching $1,000,000.
LLM mixers and named services: Jet Night and newapi[.]pro
GTIG and Mandiant identified a market for access they call LLM mixers: services that sell low-cost access to frontier models by relaying customers' prompts through hijacked API keys. The researchers found concrete examples, including jet-night.com — which offers “unlimited access plans” for $60/month — and newapi[.]pro.
One actor the report describes executed more than 500,000 LLM API calls in less than eight hours by leveraging stolen third‑party API keys to power the token‑routing service jet-night.com. Google says “Jet Night passed nearly one million dollars in token costs to the victim organization.” The pricing and proxy model lets these mixers present cheap access to subscribers while offloading the real cost onto the compromised enterprise.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTools, techniques, and a named cluster: UNC6993
The attackers use a familiar toolkit of compromised credentials and tokens: exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys. Once inside, operators hunt for credentials, logs, databases, and secret managers; they attempt to create backdoor accounts or inject SSH keys to preserve access.
GTIG highlighted a threat cluster it calls UNC6993. This cluster appears to use gateway tools to aggregate stolen keys and distribute requests, and the researchers say it likely sells access via underground forums. In some incidents attackers also used victims' cloud infrastructure to host unauthorized proxy endpoints and run agentic workloads.
CVE-2026-40217 and misuse of test endpoints
The teams documented exploitation of CVE-2026-40217, a vulnerability in LiteLLM that permits arbitrary code execution by abusing a custom‑code guardrail testing endpoint. That exploit path is one concrete example of how attackers convert software flaws into direct control over LLM infrastructure and, ultimately, a way to route high-volume requests through victims' accounts.
GTIG also described an incident where a threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs — rebranding those endpoints under a persona the researchers name D1337‑KAIROS.
Google's mitigation playbook: IAM, secrets, monitoring, and limits
To blunt LLMjacking, Google recommends starting with Identity and Access Management (IAM) and supply‑chain hygiene. Specific steps the researchers put forward include using centralized secrets platforms to rotate and manage keys, denying privileges that aren't explicitly required (including access to Cloud LLM services), and enforcing phishing‑resistant multi‑factor authentication.
Operational controls are equally prominent in the guidance: ensure monitoring tools provide comprehensive visibility to detect unauthorized LLM and AI services (so‑called shadow AI); set API usage and spending limits to limit impact; and enable and monitor cloud audit and inference logs for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging.
What this means for enterprise security teams, procurement leaders, and LLM mixers
- Enterprise security teams: Expect sudden, high-volume API traffic from stolen keys and prioritize rotating secrets, tightening IAM, and enabling detailed audit and inference logs so abnormal usage triggers alerts rather than seven-figure invoices.
- Procurement and finance leaders: Monitor API spending limits and billing anomalies; vendors selling “unlimited” access at very low prices (for example, $60/month plans advertised by jet-night.com) may be subsidized by stolen capacity.
- LLM mixers and underground resellers: The model is clear — aggregate and resell stolen access via proxy infrastructure. GTIG and Mandiant’s observations identify both the market and the operational structures that sustain it.
The picture GTIG and Mandiant paint is stark: a commercial ecosystem has formed to monetize stolen LLM access, and the consequences for victim organizations are financial, technical, and operational. The immediate defenses Google offers — tighter IAM, centralized secrets management, monitoring for shadow AI, spending limits, and audit logging — are specific steps that can prevent misuse or at least detect it before costs accumulate into the hundreds of thousands or millions.
As the researchers note, these attacks are not speculative. They documented active incidents this year that produced real invoices. The question left on the table is whether organizations will move those recommended controls from checklist to practice before more victims see the same ledger entries GTIG and Mandiant recorded.
