Google is warning organizations about a growing cybersecurity threat known as LLMjacking, in which cybercriminals hijack enterprise access to Large Language Models (LLMs) to steal expensive AI computing resources and generate unauthorized usage charges.
According to a new report from Google Threat Intelligence Group (GTIG) and Mandiant, attackers are stealing or exploiting legitimate API keys, cloud credentials, and authentication tokens to gain unauthorized access to corporate AI services. The attackers then use the compromised accounts to operate AI models, host their own services, or resell stolen access to other cybercriminals.
The financial consequences can be significant. Google researchers observed individual incidents generating more than $100,000 in fraudulent cloud charges within a single day. In some cases, cumulative charges at affected organizations reached $1 million before the unauthorized access was revoked.
The attacks have affected organizations across North America, South America, and Asia-Pacific, particularly in the financial services, retail, technology, and transportation industries.
“Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours,” Google and Mandiant explained.
What Is LLMjacking and How Does It Work?
LLMjacking is a form of resource hijacking in which attackers steal access to an organization’s AI infrastructure and use its computing resources without authorization.
The attack typically begins when cybercriminals obtain an API key or cloud authentication credential through phishing, exposed source code, misconfigured cloud environments, or leaked client-side application code.
Once they gain access, attackers can send requests to expensive AI models while the legitimate organization remains responsible for the associated computing and API usage costs.
The technique differs from traditional cryptojacking, which primarily involves secretly using compromised computers to mine cryptocurrencies.
LLMjacking directly targets the infrastructure behind AI services, allowing attackers to exploit expensive foundation models and GPU resources.
Google describes two broad forms of resource abuse. At the lower end, attackers manipulate customer support chatbots to perform unauthorized tasks, such as generating code. More advanced LLMjacking campaigns directly target backend model infrastructure by discovering exposed LLM endpoints or obtaining valid API credentials.
Stolen Cloud Credentials Are a Major Entry Point
Google identified exposed or stolen cloud identity credentials as one of the most common initial access methods.
These include:
- Identity and Access Management (IAM) credentials.
- Cloud Service Account keys.
- GitHub Personal Access Tokens (PATs).
- Active authentication session tokens.
- Exposed LLM API keys.
Such credentials can allow attackers to enter corporate cloud environments, access internal resources, and identify additional authentication information.
One campaign involved a threat actor tracked as UNC6993, which reportedly compromised a cloud instance through a misconfigured Service Account key before using the access to reach an LLM API.
Google also identified a separate credential theft technique involving a fake application portal designed to impersonate an LLM service.
The fraudulent website encouraged users to navigate to the legitimate AI service and paste a raw JSON payload containing an active authentication token. The information was then transmitted to the attacker’s backend infrastructure.
“This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multi-factor authentication (MFA) controls,” Google explained.
In another incident, an unidentified attacker used a stolen GitHub Personal Access Token to access private code repositories. The attacker subsequently exploited a suspected web application vulnerability in a package running inside a containerized cloud environment.
Other observed techniques included stealing corporate IAM credentials to generate new access keys, abusing cloud Service Account permissions, and extracting LLM API keys from publicly accessible GitHub repositories.
Attackers Expand Access Across Cloud Environments
After obtaining an initial foothold, attackers often move quickly to expand their access and establish persistence within compromised infrastructure.
Google researchers observed several techniques used to discover additional credentials, escalate privileges, and access sensitive corporate resources.
These activities included:
- Searching cloud services, source code repositories, and data stores for exposed credentials.
- Performing internal reconnaissance across cloud regions to identify available services and identity permissions.
- Cloning sensitive code repositories to locate hard-coded passwords, API keys, and configuration secrets.
- Reviewing access logs to identify credentials associated with secondary cloud environments.
- Querying databases to discover additional authentication information.
- Abusing cloud identity permissions and virtual machine configurations to maintain unauthorized access.
- Exploiting service account token-creation permissions to obtain temporary credentials with elevated privileges.
- Extracting infrastructure credentials, database passwords, and third-party API keys from cloud secret managers.
- Creating unauthorized IAM and Service Accounts to maintain persistent access.
- Injecting SSH keys into cloud computing instances.
- Creating backdoor accounts disguised as legitimate internal billing optimization utilities.
- Exploiting vulnerabilities in LLM routing software, including CVE-2026-40217 affecting LiteLLM, to escalate privileges.
These techniques allow attackers to move beyond the initially compromised account and gain access to additional cloud services, development environments, and AI infrastructure.
Hackers Monetize Stolen AI Access Through LLM Mixers
Google says the growing LLMjacking ecosystem has contributed to the emergence of a new category of cybercriminal operators known as LLM Mixers.
These actors operate illicit routing gateways that aggregate and resell unauthorized access to AI models through underground marketplaces.
Rather than directly compromising every victim organization, LLM Mixers can purchase or obtain stolen API access from other threat actors and resell it to customers seeking inexpensive access to premium AI models.
One example identified by researchers is a service called Jet Night, operating through the domain jet-night[.]com.
The service reportedly advertises unlimited token usage plans with claimed access to advanced AI models for approximately $60 per month.
This underground marketplace allows customers to consume enterprise AI quotas while the compromised organizations remain responsible for the resulting bills.
Google also observed attackers creating additional API keys to expand their operations within compromised cloud projects.
In one case involving UNC6993, unauthorized AI usage generated more than $100,000 in charges.
Some attackers also adopted a strategy known as “burn and rotate,” continuously creating and deleting short-lived Service Accounts to bypass usage restrictions and maintain access to computing resources.
Underground AI Resellers Are Abusing Legitimate Coding Tools
A separate investigation by Broadcom-owned Symantec and Carbon Black has uncovered another underground AI access service targeting enterprise environments.
According to the researchers, the service installs legitimate versions of OpenAI Codex and Anthropic Claude Code command-line interface (CLI) tools but modifies their configurations to route AI requests through third-party infrastructure.
Instead of distributing modified or trojanized applications, the operators use genuine software packages and subsequently change their configuration settings.
The investigation found that the service has been active since at least early 2026, primarily affecting approximately a dozen organizations in mainland China, along with multinational subsidiaries in South Korea, Taiwan, and Malaysia.
The targeted industries include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.
“Rather than building its own client software, the service repurposes the genuine CLI tools,” Symantec explained.
After installing the legitimate Codex or Claude Code CLI through npm, users are reportedly instructed to execute a one-line command that downloads a setup script from a lookalike domain, vibe.aiok[.]me.
The script uses PowerShell or Bash to modify the configuration of the installed applications.
Modified AI Configurations Disable Security Protections
The researchers found that the configuration changes affect different files depending on which AI coding assistant is installed.
For OpenAI Codex, the targeted configuration file is:
~/.codex/config.toml
For Anthropic Claude Code, the affected file is:
~/.claude/settings.json
The modifications reportedly make several security-related changes, including:
- Disabling the Codex execution sandbox by setting it to
danger-full-access. - Enabling network access within the write sandbox.
- Replacing users’ legitimate API credentials with tokens issued by the relay service.
- Disabling telemetry and error reporting.
- Redirecting AI requests through third-party servers instead of the official OpenAI or Anthropic infrastructure.
The setup script also checks the Windows system locale to determine whether the device is located within the region served by the operation.
Researchers suspect the service is designed partly to circumvent regional restrictions imposed by Western AI providers while offering AI access at prices below official market rates.
There is currently no evidence that the operators are exploiting this access to collect employee prompts or manipulate AI-generated responses. Nevertheless, redirecting corporate AI traffic through unauthorized third-party infrastructure creates significant security and privacy concerns.
Organizations using these tools may lose visibility into how their AI requests are handled and where sensitive information is transmitted.
Google Predicts More LLMjacking Attacks Against Enterprises
Google expects LLMjacking to become an increasingly attractive business model for cybercriminals as organizations continue adopting advanced AI models and agent-based workflows.
“Threat actors will increasingly prioritize LLMJacking over traditional resource theft like cryptojacking, driven by the immediate, high-margin monetization enabled by emerging underground LLM Mixers,” Google warned.
The company also expects attackers to improve their automated reconnaissance capabilities to identify exposed API credentials and exploit vulnerabilities in AI model routing middleware.
As enterprise dependence on AI services increases, compromised API keys and cloud credentials could provide attackers with direct access to expensive computing infrastructure.
How Organizations Can Protect Against LLMjacking
The findings highlight the importance of securing AI infrastructure with the same level of protection applied to traditional cloud environments.
Organizations should consider implementing the following security measures:
- Protect API keys and access tokens: Avoid storing sensitive credentials in public repositories, client-side applications, or unsecured configuration files.
- Apply least-privilege access: Restrict IAM roles and Service Account permissions to only the resources and operations employees actually require.
- Enable usage monitoring: Establish billing alerts and usage thresholds to detect unexpected increases in AI model consumption.
- Secure cloud environments: Regularly review cloud configurations, exposed endpoints, authentication policies, and service account permissions.
- Monitor authentication activity: Detect unusual login patterns, suspicious token creation, and unauthorized access to AI services.
- Secure AI development tools: Verify software sources and avoid running configuration scripts obtained from untrusted websites or unauthorized AI resellers.
- Audit third-party AI services: Ensure that enterprise AI tools connect to approved service providers and do not silently redirect requests through unauthorized gateways.
- Rotate compromised credentials: Immediately revoke exposed API keys, authentication tokens, and cloud credentials when suspicious activity is detected.
Conclusion
The rise of LLMjacking demonstrates how cybercriminals are adapting traditional resource hijacking techniques to exploit the growing demand for artificial intelligence.
By stealing cloud credentials and LLM API keys, attackers can consume expensive AI resources, generate substantial fraudulent bills, and monetize unauthorized access through underground marketplaces.
The emergence of LLM Mixers further complicates the threat landscape by creating an illicit ecosystem where stolen enterprise AI access can be aggregated and resold.
For businesses deploying AI-powered applications, protecting API credentials, monitoring cloud consumption, enforcing strict access controls, and verifying third-party AI tools will become increasingly important.
As Google warns, the combination of automated reconnaissance, exposed credentials, and vulnerabilities in AI infrastructure could make LLMjacking a significant cybersecurity challenge for enterprises in the coming years.
