Google’s threat researchers have documented a criminal business that steals companies’ access to artificial intelligence models and resells it, leaving victims with cloud bills that can top $100,000 in a single day. Mandiant, Google’s incident-response arm, said it handled multiple such cases during 2026, across North America, South America and Asia Pacific, and in one case nearly $1 million in token costs was passed to a single victim before access was cut off. The findings, published by the Google Threat Intelligence Group on November 2, describe a practice the researchers call LLMJacking.
How the theft works
The attacks do not start with a jailbreak or a clever prompt. They start with a stolen credential. Mandiant said the dominant route into victim environments was exposed or stolen cloud identity tokens. Those include identity management credentials, service account keys, GitHub personal access tokens and active session tokens.
Attackers also probed publicly exposed model endpoints. In one case, they called an Ollama server’s programming interface to run their own models on hardware someone else was paying for. That open door matters because an exposed endpoint can expand a company’s attack surface and inflate its hosting costs before anyone notices.
One cluster, tracked as UNC6993, showed how far a stolen key can go. In mid-2026 it compromised a cloud instance through a misconfigured service account key, then reached a language model service. The same cluster ran a session-hijacking page disguised as an application portal, tricking users into pasting a live access token that bypassed passwords and multi-factor authentication.
The same pattern surfaced in a different corner of Google’s security work this week, when its researchers dismantled a botnet built into television boxes. That case, involving a manufacturing partner’s backdoor, also turned on trusted hardware being abused at scale. It shows how the company’s incident teams now track misuse across consumer devices and enterprise cloud accounts alike.
The resale machine
What makes LLMJacking different from older resource theft is what happens next. Rather than simply burning the victim’s quota, attackers monetize it. They enable model services the victim never used, create extra API keys to scale up, and route traffic through underground gateways the researchers call LLM Mixers.
Jet Night is the clearest example. The service offered unlimited access to frontier models for about $60 a month, far below the $100 to $250 a month such access would cost. One actor made more than 500,000 model calls in under eight hours using stolen keys to power it, passing nearly $1 million in token costs to the victim organization.
Other clusters went further, building their own infrastructure on stolen access. One deployed a backdoor using the Manus agent framework, letting an agent reason through instructions and run commands locally. Another registered lookalike domains to siphon model quotas into a resale ecosystem, while a third exploited CVE-2026-40217 in LiteLLM routing software to turn virtual keys into full administrative credentials.
Our read
The economics here explain why this practice is growing faster than cryptojacking ever did. A hijacked graphics card earns its thief a trickle over months, while a hijacked model key can generate six figures in a day. The reason is simple: frontier inference is priced by the token, and the victim’s cloud account pays the bill automatically.
There is also a weakness the report exposes without naming it. Cloud accounts treat enabling a new model service as routine, so an attacker with a stolen token can switch on services the victim never approved. The finance team notices when the invoice arrives, which is why treating any enablement as a security incident is the report’s best advice.
Why It Matters
For any company, LLMJacking turns a hygiene failure, a leaked key, into a financial event. The victims Mandiant describes span financial services, retail, technology and transportation, which suggests no sector’s key management is exempt. The same logic is driving tooling elsewhere, including CrowdStrike’s kill switch for rogue agents, as vendors race to cut off automation before the meter runs.
The report also carries a warning for the resale market itself. Services offering unlimited frontier-model access at a fraction of market rates should now be treated as suspect by default. The researchers’ evidence points to stolen quotas as the only way such pricing adds up, and buyers have no guarantee the keys behind it will still work tomorrow.
Background
Google said it expects attackers to prioritize LLMJacking over resource theft as higher-tier models and agentic workflows reach production. It published detection rules for its operations customers alongside indicators including the Jet Night and newapi.pro domains. It did not name any victim or say how many incidents it investigated, so the dollar figures describe cases rather than an industry average.
Source: Google Cloud report and Infosecurity coverage.
0 Comments