Google Warns AI Account Theft Surges as Cybercriminals Sell Stolen Access at 97% Discounts

Google Identifies Sharp Rise in AI Account Theft

Google's Threat Intelligence Group has identified a significant surge in LLM-jacking attacks throughout this year, marking a troubling evolution in AI security threats1

1

. John Hultquist, chief analyst at Google Threat Intelligence Group, revealed that cybercriminals are actively stealing computing resources and selling unauthorized access to AI models from major providers including OpenAI, Anthropic and Google2

2

. Dark web marketplaces now offer these stolen credentials at discounts reaching up to 97%, creating a burgeoning underground economy centered on AI access1

1

.

Economic Incentives Drive Underground AI Markets

Premium subscriptions to services such as ChatGPT and Claude can cost as much as $200 per user per month, making stolen credentials an attractive commodity for criminal buyers1

1

. Hackers selling pilfered login credentials have established sophisticated operations, with some vendors offering "guaranteed access" services that promise replacement credentials at no charge if original accounts are suspended1

1

. This economic model gives attackers a distinct advantage, as Hultquist explained: "They can acquire that computing power at a much lower cost, while we have to pay full price to defend ourselves"1

1

.

Attackers Deploy Models on Compromised Infrastructure

Beyond AI account theft, cybercriminals have escalated tactics by breaching enterprise cloud servers to deploy their own AI models on compromised systems1

1

. This approach mirrors earlier cryptojacking operations where hackers hijacked machines to mine cryptocurrency, but now shifts heavy computing costs onto victims for AI workloads1

1

. Google researchers have observed these methods being used by both criminal groups and an active Chinese cyber espionage group that has previously targeted the United States1

1

. Companies in early stages of enterprise AI deployment face particular risk, as they may misinterpret attacker-driven spikes in computing use as normal demand from newly installed systems1

1

.

Threat Actors Exploit AI Tools Across Multiple Countries

Anthropicreported in its latest quarterly misuse report that malicious attempts to exploit Claude tools have been detected in more than two dozen countries1

1

. Hultquist emphasized the universal adoption of AI by threat actors, stating that "every threat actor is using AI" for purposes including extortion, warfare and espionage1

1

2

2

. Recent research from PYMNTS Intelligence shows 42% of companies now use three or more AI defense tools as part of layered cybersecurity frameworks, while 50% identify AI-generated vendor impersonation emails as their top threat2

2

.

Organizations Must Prioritize AI-Centric Defense Strategies

Hultquist issued a stark warning about the urgency of adapting cybersecurity frameworks to address AI-enabled threats. "Anybody who decides that AI is a fad and wants to let it just wash over them is going to wake up one day underwater," he told the Financial Times. "They're going to have more incidents, more alerts, more attacks than they've ever seen before. We have to get our house in order now"2

2

. The financial advantage that stealing computing resources provides to attackers means organizations must invest in AI-powered defense systems to match the sophistication of threats. Close to 90% of finance leaders already consider verifying vendors a moderate or major burden, highlighting the resource strain that AI-enabled fraud places on companies2

2

.