Stolen AI access leaves companies with cloud bills of up to $1 million

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found.

Usage chart showing LLMJacking generating a spike in API requests (Source: Google)

In 2026, Mandiant responded to several of these LLMJacking incidents, recorded in attacks on the financial services, retail, technology and transportation sectors in North America, South America and Asia Pacific. In some attacks the bills reached up to $1 million before the attackers lost access.

The difference between LLMJacking and cryptojacking is that cryptojacking uses up a victim’s resources slowly, while LLMJacking “can generate large spikes in fraudulent cloud charges in a matter of hours,” the researchers noted.

“The ultimate objective of LLMJacking is the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning,” they added.

Stolen keys for sale

GTIG noticed a division of labor, with one group breaking into companies’ environments and another running so-called LLM Mixers, services that collect stolen access to AI models and resell it to underground subscribers.

Jet Night, one of these services, offers an unlimited plan for about $60 a month with supposed access to the most advanced models, while a comparable legitimate subscription would cost between $100 and $250. Because of that price gap, GTIG believes the service can only turn a profit with stolen keys.

A threat actor feeding Jet Night with stolen API keys made more than 500,000 calls to AI models in less than eight hours, leaving the victim organization with nearly a million dollars in token costs. The service has announced several outages on its Telegram channel, likely because victims discovered the break-ins and revoked the keys.

In another case, an attacker registered a lookalike domain masquerading as one of the victim’s internal hosts and used it to funnel the company’s AI access into a resale operation called newapi.pro, draining the victim’s account quotas to serve paying customers.

Stolen credentials open the door

“While low-level resource theft has involved the manipulation of customer support chatbots to conduct unauthorized tasks like code generation, threat actors conducting LLMJacking bypass these front-end interfaces to target backend model resources directly. Specifically, they focus on either identifying publicly exposed LLM endpoints or obtaining valid LLM application programming interface (API) keys,” GTIG explained.

One group that harvested API keys from public GitHub repositories checked whether they worked by sending tiny requests, too small to trip the victim’s security alerts. Most often, though, the way in was a stolen cloud credential, such as a service account key, a GitHub access token or an active session token.

Researchers gave the example of the group tracked as UNC6993, which broke into a cloud instance through a misconfigured service account key and used that access to reach an AI API. The group also ran a fake portal for joining a group of LLM users, where visitors were tricked into pasting data that contained an active access token, letting the attackers get around passwords and MFA.

Digging deeper after the break-in

Once attackers get in, they look for more credentials in code repositories and databases. In one intrusion, the attacker searched data warehouse tables for database credentials, administrator passwords and sensitive columns, and carried out cloud storage operations tied to data theft.

Others created backdoor accounts to keep their access, one of them disguised as an internal billing optimization tool. In one case, an attacker exploited a vulnerability (CVE-2026-40217) in a LiteLLM gateway, used to route requests to AI models, to turn ordinary access keys into administrator credentials.

Services switched on by the intruders

Mandiant’s advice for defenders starts with watching for changes to AI accounts and services. In several incidents it investigated, the AI services had been switched off at the time of the compromise, and the attackers used stolen access keys to turn them on. From that moment, a company can run up a huge bill within minutes or hours.

GTIG expects criminals to favor LLMJacking over cryptojacking, because the resale market lets them cash in fast while the victim pays the bill.

“As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware. This operational specialization will sustain a growing illicit resale marketplace, allowing threat actors to rapidly siphon enterprise quotas while passing the billing costs to victims before compromises are detected,” the researchers concluded.