Victim organizations are facing fraudulent LLM charges that can exceed $100,000 a day, with cumulative bills at some firms reaching $1 million before intruders’ access was revoked.
Scope and scale documented by Google's Mandiant and GTIG
Google’s Mandiant incident responders reported Monday that criminals are hijacking corporate access to large language model (LLM) services and running high-volume inference and other compute workloads on victims’ accounts. The team said fraudulent charges from this resource consumption can exceed $100,000 a day, and that cumulative charges at some organizations hit $1 million before the victims revoked the intruders’ access.
Google Threat Intelligence Group (GTIG) framed the phenomenon as part of a broader push by miscreants to exploit scale. “Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties,” John Hultquist, chief analyst at GTIG, told The Register. “Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.”
LLMJacking techniques: service accounts, session hijacking, and “burn and rotate”
Mandiant’s reporting lays out multiple techniques the attackers use once they obtain API keys or service account credentials. In a mid‑2026 case, the group tracked as UNC6993 gained access through a misconfigured Service Account key and then granted further access to a model API. In that incident the intruders also created a session‑hijacking page that lured users to the legitimate LLM service and tricked them into pasting raw JSON payloads containing active access tokens; those tokens were then posted to a backend API to bypass password and multifactor authentication controls.
Other tactics target billing and account settings: attackers have subscribed victim accounts to Pay‑As‑You‑Go agreements to access advanced models at the victim’s expense, selected premium foundation models, and launched high‑volume inference streams. Mandiant also documented a “burn and rotate strategy” designed to evade rate limits by creating and deleting short‑lived service accounts while auditing billing dashboards to monitor financial impact.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHigh-volume abuse and the Jet Night token-routing service
The volume of illicit requests can be staggering. An August report from CrowdStrike showed a token thief sent about 200,000 API requests in just two minutes. In another Mandiant-documented incident an intruder executed more than 500,000 LLM API calls in less than eight hours using stolen third‑party API keys to power a token routing service called Jet Night.
GTIG noted that Jet Night’s per‑token costs to users are “so far below typical market rates” that the service likely relies on stolen keys to operate profitably. For example, Jet Night offers an unlimited token plan for approximately $60 USD per month with alleged access to frontier models, a consumer service level that would typically run between $100 and $250 per month. Jet Night has admitted to multiple outages on its public Telegram channel, which GTIG says is “likely due to stolen keys being revoked as victims discover their respective compromises.”
Division of labor: initial access actors and “LLM Mixers”
Mandiant observed an emerging criminal ecosystem in which roles are specialized. Some actors focus on establishing initial access to compromised cloud and AI services; others run downstream monetization infrastructure—what the report terms “LLM Mixers.” These mixers take stolen credentials or keys and convert them into high‑throughput, monetized access to models and inference capacity.
That division allows initial access teams to move on after compromise, while mixers operate billing‑aware, high‑volume pipelines that extract value until keys are revoked or billing thresholds are noticed by victims.
How technologists, procurement leaders, and defenders should respond
- Technologists and security teams should prioritize identity and access management plus supply‑chain controls: Mandiant recommends centralized secrets management to rotate keys and secrets, and applying least‑privilege to users and service accounts so permissions are limited to required tasks.
- Defenders should automate secrets scanning within codebases to find and remove API keys and secrets that have been added to source code, and monitor billing and API‑usage telemetry for sudden high‑volume inference streams or unusual model selections.
- Procurement and cloud operations teams should treat model‑and‑billing configurations as security‑sensitive: attackers have abused Pay‑As‑You‑Go agreements and premium model selections to drive high costs on victim accounts.
As the reports make plain, token theft is not merely an embarrassment or an accounting headache: it is a scalable avenue for attackers to both monetize stolen credentials and to buy computational firepower that can be turned into automated attacks. The remedies Mandiant and GTIG recommend—centralized secrets rotation, least‑privilege policies, automated secrets scanning, and vigilant billing telemetry—are specific and actionable. But the repeated examples of six‑figure daily bills and services built around stolen keys make clear that defenders will need to move quickly to close the gaps attackers are exploiting.
