LLMjacking attacks drain enterprise cloud budgets in hours

Google has issued a warning about a new wave of cyberattacks termed LLMjacking, where threat actors hijack enterprise access to Large Language Models. Reported on November 3, 2026, these incidents have already cost some organizations up to $1 million in fraudulent cloud computing charges before detection.

What happened

Threat actors are stealing or exposing API keys and identity tokens to gain unauthorized access to corporate LLM accounts. Unlike traditional cryptojacking, which consumes resources gradually, LLMjacking generates massive financial spikes in a matter of hours. Google Threat Intelligence Group and Mandiant observed individual incidents where fraudulent charges exceeded $100,000 USD in a single day. The attacks have impacted entities across North America, South America, and the Asia Pacific region, spanning sectors such as financial services, retail, technology, and transportation.

The attack vectors vary from low-level manipulation of customer support chatbots to direct backend exploitation. Attackers often start by obtaining cloud identity tokens, including IAM credentials, Service Account keys, or GitHub Personal Access Tokens. One specific threat actor, UNC6993, breached a cloud instance using a misconfigured Service Account key. They then used this foothold to access LLM APIs and created additional keys to scale their operations, racking up significant billing charges. In another variant, attackers trick users into pasting raw JSON payloads containing active access tokens into fake portals, effectively bypassing password and multi-factor authentication controls.

Beyond simple theft, a new ecosystem of "LLM Mixers" has emerged. These actors function as illicit routing gateways, proxying and reselling unauthorized LLM access to other criminals. Services like Jet Night offer unlimited token plans for frontier models at a fraction of the market rate, while the victim organization foots the bill. Another grey market service installs genuine CLI tools for OpenAI Codex or Anthropic Claude Code but reconfigures them to route requests through third-party infrastructure, primarily targeting regions where these vendors do not officially operate.

How it works

LLMjacking relies on the compromise of credentials rather than software vulnerabilities alone. Once an attacker gains initial access via a stolen token or exposed key, they perform internal reconnaissance to map available services and identity policies. They clone codebases to search for hard-coded secrets and scan access logs to find credentials for secondary environments. This lateral movement allows them to escalate privileges and maintain persistent access, often by creating backdoor service accounts disguised as legitimate billing utilities.

In the case of the grey market relay services, the mechanism involves repurposing official developer tools. After a user installs a legitimate CLI tool, a script overrides the configuration files, such as ~/.codex/config.toml or ~/.claude/settings.json. This script disables security sandboxes, replaces real API credentials with relay-issued tokens, and turns off telemetry. The traffic is then routed through the attacker’s servers, allowing them to monetize the enterprise’s quota while providing discounted access to end-users in restricted regions.

Key details

• LLMjacking can generate fraudulent cloud charges exceeding $100,000 USD in a single day.
• Cumulative losses for some organizations have reached $1 million USD before access was revoked.
• Common entry points include stolen IAM credentials, Service Account keys, and GitHub Personal Access Tokens.
• Threat actor UNC6993 uses session hijacking pages to steal active access tokens from users.
• LLM Mixers like Jet Night resell stolen access via underground storefronts for approximately $60 per month.
• Grey market services reconfigure genuine CLI tools to route traffic through third-party servers, disabling sandboxes.

Why it matters

For software engineers and technical leads, LLMjacking represents a shift from gradual resource theft to immediate, high-margin financial damage. The speed at which these attacks consume budgets means that traditional monthly billing reviews are insufficient for detection. Teams must now treat LLM API keys with the same severity as root database passwords, as any leak can lead to catastrophic financial exposure within hours.

The emergence of LLM Mixers also complicates the security landscape by creating a division of labor between initial access brokers and monetization infrastructure. This maturation suggests that attacks will become more automated and targeted. Engineers building agentic workflows or integrating higher-tier models into production must assume that their endpoints are high-value targets. Security practices must evolve to include strict monitoring of token usage patterns and immediate revocation capabilities.

What you can do

• Audit all cloud identity tokens and rotate Service Account keys regularly, especially those with broad permissions.
• Scan public code repositories and internal codebases for hard-coded API keys and secrets.
• Implement strict rate limits and budget alerts for LLM API usage to detect sudden spikes in consumption.
• Disable unused IAM permissions and enforce least-privilege access for all service accounts interacting with LLMs.
• Monitor for unusual configuration changes in developer CLI tools, particularly in sandboxing and network settings.
• Educate developers on the risks of using unauthorized resellers or modified CLI configurations for AI tools.