Mandiant and Google Threat Intelligence Group (GTIG) describe LLMJacking, a pattern of intrusion in which threat actors hijack enterprise access to large language models and monetize it. The post synthesizes multiple 2026 incidents across North America, South America, and Asia Pacific in financial services, retail, technology, and transportation. Unlike cryptojacking’s gradual resource drain, LLMJacking produces spikes in fraudulent cloud charges within hours; individual incidents exceeded $100,000 USD in a single day, and some organizations accumulated roughly $1 million before access was revoked.

The attack lifecycle starts with initial access. Actors bypass customer-facing chatbot surfaces and target backend model resources directly, either by finding publicly exposed LLM endpoints (for example, testing exposed Ollama endpoints and calling /api/create to register their own models) or by obtaining valid LLM API keys. More often, however, the entry vector is exposed or stolen cloud identity material: IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens. One cluster, UNC6993, compromised a cloud instance through a misconfigured Service Account key and hosted a session hijacking page masquerading as an application portal that tricked users into pasting raw JSON payloads containing active access tokens, bypassing password and MFA controls. Another actor combined a stolen PAT with a suspected web application vulnerability in a containerized package; others used cloud federation tokens to generate fresh access keys and circumvent MFA. A separate group harvested corporate LLM API keys from public GitHub repositories and validated them with minimal single-token requests (max_tokens=1) to avoid triggering EDR and SIEM volume alerts.

Once inside, actors escalate and persist. They enumerate cloud services, code repositories, and data stores; clone codebases hunting for hardcoded secrets; scan access logs for credentials to secondary environments; and query data warehouse metadata for database credentials and administrator passwords. They abuse cloud identity permissions to generate temporary credentials for high-privilege service accounts, create unauthorized IAM and service accounts, inject SSH keys into compute instances, and attach administrative policies to service roles. Threat actors also exploit vulnerabilities in LLM routing software: in one case, a follow-on cluster exploited CVE-2026-40217, a user ID rebind vulnerability in LiteLLM‘s /key/regenerate endpoint, to elevate standard Virtual Keys into full PROXY_ADMIN credentials.

The endgame is monetization through token proxying, automated model streaming, and GPU hardware provisioning. Actors enable managed generative platforms, create additional API keys, and subscribe victims to Pay-As-You-Go plans with premium models; one used a burn-and-rotate strategy of creating and deleting short-lived service accounts to bypass rate limits. Another deployed reverse proxies, a containerized backdoor using the Manus agent framework, and LiteLLM gateways, while provisioning GPU instances. GTIG observes a division of labor between initial-access actors and LLM Mixers—illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access. Actors use open-source tools such as new-api and gcli2api to pool stolen keys. One actor executed more than 500,000 LLM API calls in under eight hours through jet-night.com, passing nearly one million dollars in token costs to the victim; Jet Night‘s unlimited plan sells for about $60 per month versus a typical $100-250, which GTIG believes is only profitable on stolen keys. Another actor deployed custom proxy relay infrastructure (ai-relay) on deceptive lookalike domains to feed the newapi[.]pro resale ecosystem.

GTIG expects LLMJacking to grow relative to cryptojacking because LLM Mixers enable immediate, high-margin monetization, and expects attackers to refine automated reconnaissance targeting exposed API tokens and model routing middleware. The post includes detection guidance and notes that the activity is covered by Google SecOps rule packs such as AWS Account Key Creation, GCP Service Account Key Creation, and GCE Project SSH Keys. For AWS, defenders should monitor CloudTrail for bedrock.amazonaws.com operations including Converse, InvokeModel, ListFoundationModels, and changes to model invocation logging. For Azure, enable Diagnostic Logs for Microsoft.CognitiveServices and watch deployments/write operations plus inference endpoints. For GCP, Gemini Enterprise Agent Platform data access logs are disabled by default and must be explicitly enabled; monitor aiplatform.googleapis.com prediction operations and ServiceUsage.EnableService.

Mitigation centers on IAM and supply-chain hygiene: centralized secrets management, least privilege, automated secret scanning, configuration audits, rate limiting, network allow-listing, granular API quotas with budget alerts, phishing-resistant MFA, shadow LLM discovery, granular API key scopes, monitoring for validation sweeps, patching gateways such as LiteLLM, sandboxed execution for dynamic workloads, vetted model repositories, graph-based risk prioritization, and automated adversarial exposure validation. Network IOCs shared in a GTI Collection include jet-night.com and newapi.pro as LLM Mixers.