Google Warns LLMjacking Attacks Cost Enterprises Up To $1 Million In Cloud Bills

Google on Monday warned that threat actors are systematically hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic, dubbed LLMjacking, involves attackers obtaining API keys through phishing, source code leaks, misconfigured environments, or exposed client-side code to gain unauthorized access while the legitimate owner covers the consumption costs.

"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News. "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked."

These attacks have a wide geographical footprint, impacting entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors. The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens.

This includes a specific threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key to obtain access to an LLM API. "UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users," Google noted. "This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multi-factor authentication (MFA) controls."

Upon gaining a foothold, threat actors immediately escalate privileges and conduct internal reconnaissance. Observed tactics include:

• Enumerating cloud services, code repositories, and data stores for sensitive credentials.
• Performing internal reconnaissance across multiple cloud regions to map available services and identity policies.
• Cloning sensitive codebases to search for hard-coded secrets, configuration variables, and developer credentials.
• Scanning access logs to identify credentials for secondary cloud environments.
• Running targeted database queries to harvest additional credentials.
• Abusing cloud identity permissions and virtual machine configurations to escalate privileges and maintain persistent access.
• Exploiting token-creation privileges associated with service accounts to generate temporary credentials for high-privilege service accounts and exfiltrate infrastructure credentials, internal database passwords, and third-party API keys from cloud secret managers.
• Creating unauthorized IAM and service accounts and injecting SSH keys into compute instances for persistence.
• Creating backdoor service accounts disguised as internal billing optimization utilities.
• Exploiting vulnerabilities targeting LLM routing software, such as CVE-2026-40217 in LiteLLM, to escalate privileges.

"The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning," Google stated. "Threat actors also leveraged their access to host their own proxy endpoints and agentic workloads." UNC6993, for instance, has created additional API keys to scale operations within victim cloud projects, racking up over $100,000 USD in billing charges.

The maturation of the LLMjacking ecosystem has paved the way for a new category of actors called LLM Mixers, who function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to other criminal actors via underground storefronts. One such service is Jet Night ("jet-night[.]com"), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month.

By fueling an illicit resale marketplace, these services permit bad actors to siphon enterprise quotas while passing the billing costs to victims before compromises are detected. According to a report published by Broadcom-owned Symantec and Carbon Black last week, there exists another grey market relay service that installs genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request through third-party infrastructure instead of the vendors' own servers.

"Rather than building its own client software, the service repurposes the genuine CLI tools," Symantec said in a report published by Broadcom-owned Symantec and Carbon Black last week. "It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex's case by setting it to 'danger-full-access,' and routes every request through its own servers instead of OpenAI's or Anthropic's."

The service appears to mainly target markets where Anthropic and OpenAI do not operate. The installation is driven by an employee attempting to try out a Western AI coding assistant by turning to an unauthorized reseller. Notably, the service does not distribute a modified or trojanized client; shortly after the legitimate install of the Codex or Claude Code CLI through npm, users are likely instructed to run a one-line command to fetch fileless PowerShell or bash setup script from a lookalike domain ("vibe.aiok[.]me") that overrides the configuration.

The reconfiguration targets "~/.codex/config.toml" for Codex or "~/.claude/settings.json" for Claude Code, disabling the CLI's execution sandbox, enabling network access for the write sandbox, replacing the user's real API credentials with relay-issued tokens, and disabling telemetry and error reporting. It is suspected that operators are circumventing regional restrictions imposed by Western AI vendors while reselling capacity below market rates similar to Jet Night.

Although there is no evidence to suggest that the service is abusing its position to harvest prompts entered by employees or fabricate or alter responses, the findings demonstrate the security risks associated with using such tools. Google concluded that "Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers." As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals are expected to refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware.