LLMjacking Attacks Generate $100K+ Daily in Fraudulent Cloud Charges as Token Thieves Target AI

Token Thieves Exploit Corporate AI Infrastructure

Cybercriminals are draining corporate budgets through LLMjacking attacks that hijack company AI usage and generate fraudulent cloud charges exceeding $100,000 per day1

1

. According to a report from Google's Mandiant incident responders and Google Threat Intelligence Group, some victim organizations saw cumulative charges hit $1 million before they discovered and revoked the unauthorized LLM access2

2

. This emerging threat represents a significant escalation from traditional cryptojacking, where resource consumption builds gradually over time.

How Attackers Monetize Compromised Cloud Resources

The LLMjacking ecosystem operates through systematic exploitation of stolen AI API keys and cloud credentials. Threat actors begin by targeting publicly exposed LLM endpoints or obtaining valid API keys through compromised cloud identity tokens, including IAM credentials, Service Account keys, and GitHub Personal Access Tokens3

3

. Once inside, they escalate privileges and solidify access to maximize their illicit LLM charges. In one documented case, the threat group UNC6993 compromised a cloud instance through a misconfigured Service Account key, then generated additional API keys and enabled services within victim cloud projects, quickly accumulating over $100,000 in billing charges1

1

.

Another attacker subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, this threat actor deployed a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts while monitoring the billing interface to track financial impact2

2

. In an extreme case documented by CrowdStrike in August, token thieves sent approximately 200,000 API requests in just two minutes1

1

.

LLM Mixers Create Underground Marketplace

The LLMjacking threat landscape now features specialized operators called LLM Mixers who manage downstream monetization infrastructure. These operators run routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers2

2

. Google documented a clear division of labor between groups that establish initial access to compromised cloud and AI services and those who operate the monetization platforms.

One prominent example is Jet Night, a token routing service powered by stolen third-party API keys. An intruder executed more than 500,000 LLM API calls in less than eight hours using stolen keys to operate this service1

1

. Jet Night offers an unlimited token plan for approximately $60 per month with alleged access to frontier models—a price point far below typical market rates of $100 to $250 per month3

3

. The service has admitted to multiple outages on its public Telegram channel, which Google threat hunters attribute to stolen AI API keys being revoked as victims discover compromises1

1

.

Session Hijacking and Social Engineering Tactics

Attackers employ sophisticated session hijacking techniques to bypass security controls. UNC6993 created a fake portal purporting to be an application to join a group of LLM users. This page tricked users into navigating to the legitimate LLM service website and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multifactor authentication controls1

1

. Another actor scraped LLM API keys from public GitHub repositories and validated each one with requests capped at a single output token—a technique that slipped under volume-based security alerts3

3

.

Growing Threat to AI Security

Google predicts threat actors will increasingly prioritize LLMjacking compared to cryptojacking due to faster payouts and higher profit margins. "Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties," said John Hultquist, chief analyst at Google Threat Intelligence Group1

1

. Victims span North America, South America, and Asia-Pacific, including financial services, retail, technology, and transportation companies3

3

.

Protect Against Token Thieves

Defenders should prioritize identity and access management plus supply chain security to prevent unauthorized LLM access. Use centralized secrets management platforms to rotate keys regularly, and implement least privilege access principles ensuring users and service accounts only have necessary permissions1

1

. Automate secrets scanning within codebases to identify and remove API keys added to source code. Treat any unauthorized enablement of LLM services as a critical security event—in several Mandiant cases, victims had never enabled these services before attackers turned them on using stolen credentials3

3

. Implement spending caps, scope API keys to specific models and environments, and monitor logs for single-token validation pings used to test stolen keys.