Google Flags LLMjacking Surge as Cloud Bills Hit $1 Million

Google warned Monday that attackers are hijacking enterprise access to large language models to run up fraudulent cloud charges, a tactic known as LLMjacking. Threat actors obtain API keys through phishing, leaked source code, misconfigured environments or exposed client-side code, and the victim organization foots the bill.

According to Google Threat Intelligence Group and Mandiant, fraudulent charges exceeded $100,000 in a single day in some incidents, with cumulative costs at certain organizations reaching $1 million before access was revoked. Affected entities span North America, South America and Asia Pacific, across financial services, retail, technology and transportation.

The most common entry point is exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens and active session tokens. A threat actor tracked as UNC6993 breached a cloud instance via a misconfigured service account key and used a fake session-hijacking portal to trick users into pasting access tokens, bypassing password and multi-factor authentication.

Once inside, attackers escalate privileges, move laterally and hunt for more credentials. Some adopt a "burn and rotate" approach, repeatedly creating and deleting short-lived service accounts to dodge rate limits. Google also described LLM Mixers, illicit routing gateways such as Jet Night that resell unauthorized LLM access, with one plan advertised at roughly $60 per month.

Separately, Symantec and Carbon Black reported a grey-market relay service that installs genuine OpenAI Codex and Anthropic Claude Code tools on enterprise systems, then reconfigures them to route requests through third-party servers. Assessed active since at least early 2026, it has mainly hit about a dozen organizations in mainland China along with subsidiaries in South Korea, Taiwan and Malaysia. Google said it expects LLMjacking to increasingly replace cryptojacking as enterprises adopt higher-tier models and agentic workflows.

Source: The Hackers News