Hackers Launch LLMHijacking Attacks, Leaving Companies With $1 Million in Cloud Bills

Hackers are stealing access to corporate large language models and reselling it, leaving victims with cloud bills reaching $1 million. Mandiant investigated multiple incidents during 2026 where unauthorized AI use generated more than $100,000 in charges in a single day, showing how quickly stolen credentials can become a major financial loss.

Google Threat Intelligence Group (GTIG) detailed the activity in research published November 2. The attacks affected financial services, retail, technology, and transportation organizations across North America, South America, and Asia Pacific. Known as LLMJacking, the technique targets paid AI resources rather than using stolen computing power to mine cryptocurrency.

The main entry point was exposed or stolen cloud credentials, including service account keys, GitHub personal access tokens, and active session tokens. Previous Cybersecurity News reporting on LLMjacking through a leaked AWS key describes a similar path from stolen access to unauthorized model use.

Attackers also collected corporate LLM API keys from public GitHub repositories. To check whether keys worked without creating obvious traffic spikes, one group sent tiny requests using max_tokens=1. These low-volume tests stayed below the victim’s security alert thresholds before larger abuse began.

One tracked group, UNC6993, used a misconfigured service account key to reach cloud resources. It also operated a fake membership portal that persuaded users to paste session data containing active access tokens. Reusing those tokens allowed access without completing a fresh password or multifactor authentication check.

Stolen AI Access Becomes a Resale Business

According to Mandiant’s investigation, attackers increasingly split responsibilities. Some groups break into enterprise environments, while others run “LLM Mixers,” routing services that combine stolen credentials and sell unauthorized model access to paying subscribers. The victim receives the bill while the operators collect revenue.

In one incident, an attacker made more than 500,000 LLM API calls in under eight hours using stolen third-party keys. The activity powered Jet Night, a token-routing service that passed nearly $1 million in costs to one organization. GTIG believes its unusually cheap plans depend on stolen access.

Credential theft is not the only concern. Attackers also searched private repositories, databases, and secret managers for additional passwords and keys. The risk mirrors concerns raised in Cybersecurity News coverage of the Northflank security incident, although that separate investigation has not established a link to these operations.

Some intruders created administrator accounts, added SSH keys, and disguised backdoor service accounts as billing tools. In another case, Mandiant reported exploitation of LiteLLM flaw CVE-2026-40217 through /key/regenerate, allowing ordinary virtual keys to gain PROXY_ADMIN privileges and giving attackers lasting gateway control.

The GTIG guidance urges defenders to treat unexpected activation of AI services as a critical warning. Several victims had not enabled LLM services before the intrusion. Teams should investigate new access keys, rapid account creation and deletion, unusual model requests, and attempts to disable logging.

Organizations should rotate exposed secrets, restrict permissions, scan repositories for keys, patch gateways, and enforce model-specific quotas. Monitoring must include tiny validation requests, not just spending spikes. Revoking the first stolen key is insufficient when attackers have already created replacement accounts or other persistent access.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Launch LLMHijacking Attacks, Leaving Companies With $1 Million in Cloud Bills appeared first on Cyber Security News.