Google Warns LLMjacking Can Drive Enterprise Cloud Charges to $1 Million
Summary
Google reports LLMjacking incidents using exposed or stolen cloud and API credentials to misuse enterprise LLMs, with daily charges exceeding $100,000 and some bills reaching $1 million; illicit relays also resell access and reconfigure legitimate AI CLI tools.
Key points
- Google Threat Intelligence Group and Mandiant report that LLMjacking incidents have generated over $100,000 in charges in a day, with some organizations accumulating up to $1 million before access was revoked.
- Common access routes include exposed or stolen cloud identity tokens, IAM credentials, Service Account keys, GitHub Personal Access Tokens, session tokens, and LLM API keys.
- Google said actor UNC6993 used a misconfigured Service Account key to access an LLM API and a session-hijacking page to collect active access tokens.
- Actors monetize access through token proxying, automated model streaming, GPU provisioning, and proxy endpoints; some create and delete short-lived service accounts to evade rate limits.
- Google describes LLM Mixers as services that route and resell unauthorized LLM access. Jet Night allegedly offers an unlimited-token plan for about $60 per month.
- A separate relay service reportedly reconfigures legitimate Codex and Claude Code CLI installations to route requests through third-party servers, disable sandboxing, and replace users’ API credentials. A setup script was fetched from vibe.aiok[.]me.
- The cited findings report no evidence that the relay service harvested employee prompts or altered responses.
Article Details
- Event Type
- Threat intelligence warning about LLMjacking and unauthorized resale of enterprise LLM access
- Impact
- Google Threat Intelligence Group and Mandiant reported that individual incidents involved fraudulent resource-consumption charges exceeding $100,000 in a day, with cumulative charges at some organizations reaching $1 million before access was revoked. The attacks use exposed or stolen credentials to consume enterprise LLM resources. A separate report described a relay service reconfiguring legitimate Codex and Claude Code CLIs to route requests through third-party servers; the operators’ motives and any prompt harvesting were not confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jet-night[.]com | Domain for Jet Night, described as an illicit routing gateway reselling unauthorized LLM access. |
| DOMAIN | vibe[.]aiok[.]me | Lookalike domain used to fetch a setup script that reconfigures Codex or Claude Code to use relay-issued tokens and third-party servers. |
MITRE ATT&CK
T1078 · Valid AccountsAttackers used stolen cloud identity credentials, including IAM credentials and Service Account keys, to access target organizations’ environments.T1098.001 · Additional Cloud CredentialsUNC6993 created additional API keys in victim cloud projects to scale operations.T1528 · Steal Application Access TokenThe reported attacks involved obtaining and using active application access tokens.T1552.001 · Credentials In FilesThe article reports LLM API keys obtained from public GitHub repositories.T1566 · PhishingGoogle said UNC6993 hosted a session-hijacking page that tricked users into submitting an active access token.
Threat Actors
Vendors
AnthropicBlack last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request throughOpenAISymantec and Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every
Products
Claude Codeweek, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request through third-partyCodexand Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to reconfigure them to route every request
Countries
Mainland Chinaassessed to be active since at least early 2026, primarily impacting a dozen organizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectorsMalaysialocated in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors,South Koreaa dozen organizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing,Taiwanorganizations located in Mainland China, along with multi-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors,
Industries
Data center servicesmanufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.Electronics manufacturingbased in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data centerFinancial ServicesSuch attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.Industrial automationmulti-national subsidiaries based in South Korea, Taiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing,Petrochemicalsautomation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.PharmaceuticalsMalaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.RetailSuch attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.SemiconductorsTaiwan, and Malaysia. Targeted sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.Shippingsectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.TechnologySuch attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.Tire manufacturingindustrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.TransportationSuch attacks have a wide geographical footprint, with impacted entities located in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.