Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.
The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code to gain unauthorized access to an organization’s LLM accounts, while the legitimate owner covers the consumption costs.
Such attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.
“Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours,” Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News.
“Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.”
On one end of the spectrum are low-level resource theft that involves the manipulation of customer support chatbots to conduct unauthorized tasks like code generation. LLMjacking is on the other end, as they target the backend model resources directly by identifying publicly exposed LLM endpoints or obtaining valid LLM API keys.
The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens, which allow an attacker to establish an initial foothold into target organizations’ infrastructure.
This includes a threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key and used it to obtain access to an LLM API.
“UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users,” Google said. “This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multi-factor authentication (MFA) controls.”
In another case, an unknown attacker has been observed leveraging a stolen Personal Access Token to access private code repositories, following it up with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment.
Other initial access routes include the compromise of IAM credentials of corporate users to programmatically generate fresh access keys to bypass MFA safeguards, as well as the use of a hacked cloud Service Account key with broad project permissions and LLM API keys obtained from public GitHub repositories.
Upon successfully gaining a foothold, the threat actors waste no time escalating privileges, burrowing deeper into the network, establishing persistence, and conducting internal reconnaissance to identify targets and further cloud credentials for lateral movement.
Some of the observed tactics are listed below –
- Enumerate cloud services, code repositories, and data stores for sensitive credentials.
- Perform internal reconnaissance across multiple cloud regions to map available services and identity policies.
- Clone sensitive codebases to search for hard-coded secrets, configuration variables, and developer credentials.
- Scan access logs to identify credentials for secondary cloud environments.
- Run targeted database queries to harvest additional credentials.
- Abuse cloud identity permissions and virtual machine configurations to escalate privileges and maintain persistent access.
- Exploit token-creation privileges associated with service accounts to generate temporary credentials for high-privilege service accounts and exfiltrate infrastructure credentials, internal database passwords, and third-party API keys from cloud secret managers.
- Create unauthorized IAM and service accounts and inject SSH keys into compute instances for persistence.
- Create backdoor service accounts disguised as internal billing optimization utilities.
- Exploit vulnerabilities targeting LLM routing software, such as CVE-2026-40217 in LiteLLM, to escalate privileges.
“The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning,” Google said. “Threat actors also leveraged their access to host their own proxy endpoints and agentic workloads.”
UNC6993, for instance, has created additional API keys to scale their operations within victim cloud projects, racking up over $100,000 USD in billing charges. Some threat actors attempt to bypass rate limits by adopting a “burn and rotate” strategy that involves continuously creating and deleting short-lived service accounts
The maturation of the LLMjacking ecosystem has also paved the way for the emergence of a new category of actors called LLM Mixers, highlighting a division of labor between attackers who establish initial access and those who manage downstream monetization infrastructure.
LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to other criminal actors via underground storefronts. One such service is Jet Night (“jet-night[.]com”), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month.
By fueling an illicit resale marketplace, it permits bad actors to siphon enterprise quotas while passing the billing costs to victims before compromises are detected.
Jet Night is far from the only token routing offering. According to a report published by Broadcom-owned Symantec and Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request through third-party infrastructure instead of the vendors’ own servers.
The service is assessed to be active since at least early 2026, primarily impacting a dozen organizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.
“Rather than building its own client software, the service repurposes the genuine CLI tools,” Symantec said. “It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex’s case by setting it to ‘danger-full-access,’ and routes every request through its own servers instead of OpenAI’s or Anthropic’s.”
The service appears to mainly target markets where Anthropic and OpenAI do not operate, with the installation driven by an employee attempting to try out a Western AI coding assistant by turning to an unauthorized reseller.
Notably, the service does not distribute a modified or trojanized client. Shortly after the legitimate install of the Codex or Claude Code CLI through npm, users are likely instructed to run a one-line command to fetch fileless PowerShell or bash setup script from a lookalike domain (“vibe.aiok[.]me”) that’s used to override the configuration.
The reconfiguration, which targets “~/.codex/config.toml” for Codex or “~/.claude/settings.json” for Claude Code, disables the CLI’s execution sandbox, enables network access for the write sandbox, replaces the user’s real API credentials with relay-issued tokens, and disables telemetry and error reporting.
The script also checks the Windows locale setting to confirm it’s running on a system in the region it serves before the setup is completed. It’s suspected that the operators behind the service are not only circumventing regional restrictions imposed by Western AI vendors, but are also reselling capacity below market rates similar to Jet Night.
Although there is no evidence to suggest that the service is abusing its position to harvest prompts entered by employees or fabricate or alter responses, the findings demonstrate the security risks associated with using such tools.
“Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers,” Google said.
“As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware.”
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
