Google: LLMjacking attacks drive up to $1 million in fraudulent cloud AI charges

Large language model hijacking attacks, known as LLMjacking, are producing substantial fraudulent cloud charges, with some organizations losing more than $100,000 in a single day, according to researchers at Google's Threat Intelligence Group (GTIG) and Mandiant. In incidents the teams analyzed, cumulative costs reached as high as $1 million, driven by fraudulent API calls made with stolen keys. The researchers described two distinct operational clusters that coordinate to compromise and monetize enterprise LLM infrastructure. One category scans for publicly exposed LLM endpoints, while the other steals valid API keys from unprotected machines. After gaining initial access, attackers sell it to services known as LLM mixers, which give their subscribers unauthorized access to large language models. Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The cloud provider records the traffic as legitimate consumption and bills the victim organization for the tokens. GTIG and Mandiant said they observed an increase in this type of activity this year. The mixers offer AI resources at very low prices, using proxy infrastructure to relay customer prompts to hijacked services through stolen API keys. Examples identified by the researchers include Jet Night, which sells unlimited access plans for $60 per month, and the service newapi[.]pro. Google said one threat actor executed more than 500,000 LLM API calls in less than eight hours, using stolen third-party API keys to power the token routing service jet-night.com. Jet Night passed nearly one million dollars in token costs to the victim organization. Google also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access through underground forums. The attackers obtain access through exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys. Once inside, they search the environment for credentials, logs, databases, and secret managers, and attempt to create backdoor accounts or inject SSH keys to maintain persistent access. The researchers also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows arbitrary code to run on the server through the custom-code guardrail testing endpoint. In some cases, attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads. Google cited one actor that enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs under the persona D1337-KAIROS. To defend against these attacks, Google recommends prioritizing identity and access management and securing the supply chain. Organizations should use centralized secrets platforms to rotate and manage sensitive keys, and users should not hold extended privileges beyond what their roles and tasks require. Google advised denying all permissions that are not explicitly required, including access to cloud LLM services. Additional measures include enforcing phishing-resistant multi-factor authentication, ensuring monitoring tools provide comprehensive visibility to identify unauthorized AI services, and setting API usage and spending limits. Cloud audit and inference logs should be enabled and reviewed for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging, the researchers said.