Financially motivated threat actors are increasingly targeting enterprise artificial intelligence infrastructure, using hijacked cloud accounts and stolen API tokens to siphon costly foundation model compute. Security researchers at Google's Threat Intelligence Group and Mandiant revealed that these "LLMjacking" campaigns have generated fraudulent cloud bills exceeding $100,000 in a single day, with total losses reaching $1 million at individual victim organizations before access was revoked.

According to reporting from BleepingComputer and The Hacker News, the activity affects organizations across North America, South America, and the Asia-Pacific region. The targeted sectors include financial services, technology, transportation, and retail.

The Rise of LLM Mixers

Researchers observed a distinct operational division of labor within the LLMjacking ecosystem. One set of actors focuses on discovering exposed endpoints or stealing valid credentials, while specialized downstream syndicates operate illicit relay gateways known as "LLM mixers."

These mixer platforms aggregate stolen API keys and provide cheap, unauthorized foundation model access to paying subscribers on cybercrime forums. One documented service, operating under the name Jet Night, offered unlimited access plans for approximately $60 per month while funneling customer prompts through compromised enterprise accounts. In one analyzed incident, an actor executed more than 500,000 model requests in under eight hours through stolen third-party keys, generating nearly $1 million in billing charges for a single victim organization.

Unlike traditional cryptojacking, which typically consumes hardware resources at a steady pace to avoid detection, LLMjacking can produce sudden and massive spikes. In some environments, request traffic abruptly climbed to more than 1,000 calls per second, registered by cloud providers as legitimate consumption.

Infiltration Vectors and Lateral Movement

Threat groups rely on several initial compromise methods to secure backend LLM access. The most frequent pathways involve compromised Identity and Access Management (IAM) credentials, Service Account keys, GitHub Personal Access Tokens, and active browser session tokens. In some instances, actors scour public code repositories for leaked API secrets or deploy phishing pages that trick developers into submitting raw session payloads containing active authorization tokens.

Attackers also leverage known vulnerabilities in artificial intelligence middleware. Researchers observed exploitation of CVE-2026-40217, an arbitrary code execution vulnerability affecting the custom-code guardrail testing endpoint in LiteLLM. Once code execution is established, intruders perform internal cloud reconnaissance, scan logs and databases for secondary secrets, and clone proprietary codebases.

To maintain persistent footholds, actors inject unauthorized SSH keys into compute instances, create backdoor cloud accounts disguised as internal billing optimization utilities, and deploy custom reverse proxies. Google highlighted a threat group tracked as UNC6993, which created and rotated short-lived service accounts to scale operations and circumvent provider-enforced rate limits. Another actor deployed agentic workloads and custom Node.js reverse proxies to resell multi-model access under the persona D1337-KAIROS.

Relay Abuse in Global Operations

As documented by Infosecurity Magazine, the financial appeal of foundation model access is causing cybercriminals to favor LLMjacking over legacy resource-theft operations. The wider abuse ecosystem also intersects with unauthorized grey-market relays.

Separate research from Symantec and Carbon Black cited in the reports identified a grey-market service active since early 2026 across Asia-Pacific manufacturing, semiconductor, and data center firms. The operation directed employees trying to bypass regional model restrictions to execute setup scripts that reconfigured legitimate OpenAI Codex and Anthropic Claude Code command-line tools. These scripts disabled internal execution sandboxes and rerouted traffic through external relay servers, exposing local environments while reselling underlying model capacity below market rates.

What You Should Do

Defending against LLMjacking requires robust identity controls, rigorous secret hygiene, and active cloud cost monitoring. Security teams should implement the following measures:

  • Apply strict least privilege: Deny access by default to cloud-hosted foundation model APIs and LLM infrastructure. Restrict permissions to only those service accounts and developers that explicitly require them.
  • Enforce centralized secrets management: Store all API keys, access tokens, and cloud credentials in dedicated secret managers with automated rotation. Eliminate hard-coded secrets from source code, container configurations, and public repositories.
  • Enforce phishing-resistant MFA: Require hardware tokens or FIDO2-compliant multi-factor authentication across all developer and administrative portals to prevent session hijacking.
  • Establish spending and rate limits: Configure strict budgetary alerts, hard spending caps, and anomaly detection rules within cloud and model provider consoles to catch rapid spikes in token consumption.
  • Patch AI middleware: Verify that local and cloud-hosted model orchestration tools, including LiteLLM, are updated against vulnerabilities such as CVE-2026-40217.
  • Audit inference and identity logs: Enable cloud audit trails and inference logging. Monitor for unusual token-generation events, geographic anomalies, and unexpected spikes in prompt volumes.