Google finds ‘LLMjacking’ attackers running up $100K a day in fraudulent cloud charges

A new report from Google's Mandiant and Threat Intelligence Group reveals that attackers hijacking enterprise access to large language models are incurring fraudulent cloud charges of over $100,000 daily. The report, titled "The Rise of LLMJacking," details several cases where malicious actors monetized compromised cloud and model resources.

In some instances, the total bill reached $1 million before access was revoked. Victims across North America, South America, and Asia-Pacific included financial services, retail, technology, and transportation companies. The intrusions were often facilitated by stolen or exposed cloud identity credentials, such as service account keys and GitHub personal access tokens.

Other attackers targeted LLM endpoints left open to the internet, like unsecured Ollama servers. A group called UNC6993 exploited misconfigured service account keys and used fake LLM sign-up pages to steal access tokens, which unlocked premium services. Another actor scraped LLM API keys from public GitHub repositories and tested them, evading volume-based alerts.

Some attackers gained access through vulnerabilities, like CVE-2026-40217 in LiteLLM's key regeneration endpoint. The attackers then used a "burn and rotate" strategy, creating and deleting short-lived service accounts to bypass rate limits. Stolen access was used directly, for pay-as-you-go premium model agreements, or sold through "LLM Mixers," which masked request origins using open-source API gateways and custom relays.

Notable tools like new-api and gcli2api were used by UNC6993 to pool stolen keys. One group generated over 500,000 LLM API calls in under eight hours, incurring nearly $1 million in token costs. GTIG predicts LLMjacking will become more prevalent than cryptojacking as companies adopt higher-tier models and agentic workflows. To mitigate risks, organizations should treat unauthorized LLM service enablement as a critical security event and implement spending caps, scoped API keys, and log monitoring for single-token pings.