LLMjacking Attacks Drive Cloud AI Charges Above $1 Million, Google Says
Summary
Google GTIG and Mandiant report LLMjacking incidents that drove cloud AI charges above $100,000 per day and up to $1 million at some organizations, using exposed endpoints or stolen credentials and API keys to resell access.
Key points
- Google GTIG and Mandiant observed two operational clusters: one scanning for exposed LLM endpoints and another stealing valid API keys.
- Attackers resell unauthorized access through LLM mixers; request spikes can exceed 1,000 requests per second and generate charges above $100,000 in a day.
- Researchers say some organizations accumulated as much as $1 million in fraudulent token costs; one actor reportedly made more than 500,000 API calls in under eight hours.
- Attackers seek cloud credentials, service account keys, GitHub tokens, session tokens, and API keys, and may create backdoor accounts or add SSH keys for persistence.
- Google observed exploitation of CVE-2026-40217 in LiteLLM, which can allow arbitrary code execution through its custom-code guardrail testing endpoint.
- Google recommends least-privilege access, centralized secrets management and key rotation, phishing-resistant MFA, usage and spending limits, and monitoring cloud audit and inference logs.
Article Details
- Event Type
- LLMjacking attacks using stolen API keys and compromised or exposed cloud credentials to resell unauthorized access to enterprise LLM infrastructure.
- Impact
- Google and Mandiant report fraudulent cloud charges exceeding $100,000 in a day for some organizations and cumulative costs reaching $1 million. One reported threat actor made more than 500,000 API calls in less than eight hours; attackers also used victim cloud infrastructure for unauthorized proxy endpoints and agentic workloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jet-night[.]com | Google says a threat actor used this token-routing service with stolen third-party API keys to make more than 500,000 LLM API calls in less than eight hours. |
| DOMAIN | newapi[.]pro | Identified by researchers as LLM-mixer relaying infrastructure for unauthorized access to hijacked LLM services. |
MITRE ATT&CK
T1078 · Valid AccountsAttackers used stolen or compromised cloud credentials, service account keys, session tokens, and LLM API keys to gain access.T1098.004 · SSH Authorized KeysResearchers observed attackers attempting to inject SSH keys to maintain persistent access.T1136 · Create AccountResearchers observed attackers attempting to create backdoor accounts for persistent access.T1190 · Exploit Public-Facing ApplicationAttackers reportedly exploited CVE-2026-40217 through LiteLLM's custom-code guardrail testing endpoint to run arbitrary code on the server.