Criminals who break into a company's cloud account no longer need to mine cryptocurrency to make it pay. According to a new report from Google Threat Intelligence Group (GTIG) and Mandiant, they are switching on the victim's AI services and running up model bills instead, a practice known as LLMJacking. In incidents Mandiant handled this year, fraudulent charges topped $100,000 in a single day, and some organizations reached $1 million before the access was cut off.
That speed is what separates LLMJacking from cryptojacking. Stolen mining capacity drains a budget slowly; hijacked frontier model access can spike a bill within hours. Google says the intrusions hit financial services, retail, technology and transportation organizations in North America, South America and Asia Pacific, across several cloud and model providers.
Stolen cloud keys, not clever prompts, open the door
Some actors simply hunt for AI endpoints left open to the internet, such as exposed Ollama servers, and run their own models on them. But GTIG says the dominant way in has been exposed or stolen cloud identity material: IAM credentials, service account keys, GitHub personal access tokens and live session tokens. One cluster, tracked as UNC6993, abused a misconfigured service account key and also ran a fake portal that tricked users into pasting a raw JSON payload carrying an active access token, which sidestepped both password and multifactor checks.
Another group scraped corporate LLM API keys from public GitHub repositories and tested each one with single-token requests (max_tokens=1), small enough to slip under volume-based alerting. Once inside, intruders cloned repositories to hunt for hardcoded secrets, queried data warehouse metadata for passwords, created backdoor service accounts disguised as billing utilities, and injected SSH keys into compute instances.
One follow-on cluster bought pre-validated keys from the actor that got in first, then exploited a user ID rebind flaw in the /key/regenerate endpoint of the victim's LiteLLM gateway, CVE-2026-40217, to turn ordinary virtual keys into full PROXY_ADMIN credentials. Google did not publish a CVSS score for the bug in this report.
A resale market built on somebody else's bill
The money is increasingly made downstream. GTIG describes "LLM Mixers", illicit gateways that pool stolen keys, meter usage and resell AI access to underground subscribers. UNC6993 used open-source tools such as new-api and gcli2api, likely to aggregate stolen keys and balance load across accounts. One actor that made more than 500,000 API calls in under eight hours used stolen third-party keys to power a token resale service called Jet Night, which passed nearly $1 million in costs to one victim. Google notes the service sells an unlimited plan for about $60 a month, well below market rates, and assesses it relies on stolen keys to stay profitable. Another actor fed hijacked quota into the newapi[.]pro resale ecosystem through lookalike domains posing as the victim's own hosts.
This fits a pattern IntelFusions has tracked for weeks, from phishers hijacking Google Cloud billing to run up Gemini usage to stolen keys from a wave of AI developer platform breaches being burned on Amazon Bedrock.
Alert on AI services being switched on
Mandiant found that in several cases the AI services were not even enabled before the compromise; the attackers turned them on. Google's advice is to treat any unauthorized enablement of Bedrock, the Gemini API or similar services as a critical event, and to:
- Deny AI service permissions to identities that do not need them, and scope API keys to specific models and environments.
- Set per-model quotas and spending caps so a stolen key cannot run unlimited.
- Scan code repositories for committed secrets and rotate keys through a central secrets manager.
- Watch gateway logs for tiny validation requests such as max_tokens=1.
- Patch model routing gateways such as LiteLLM, including against CVE-2026-40217.
- On AWS, monitor CloudTrail for InvokeModel, Converse and PutModelInvocationLoggingConfiguration calls, and treat logging changes by non-IaC principals as high severity.
Google expects attackers to keep favouring LLMJacking over cryptojacking because the payout is immediate. For defenders, the lesson is that an AI budget is now an asset worth stealing, and the bill may be the first alarm anyone hears. For a government view of the same risk, see CISA's guidance on AI token exhaustion.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.