Cybercriminals Exploit Enterprises Through LLMjacking: A Growing Threat in AI Business
In an increasingly digital landscape, enterprises leveraging large language models (LLMs) for their operations may unknowingly become victims of a cunning cybercrime known as LLMjacking. According to a recent warning from the Google Threat Intelligence Group (GTIG), this emerging threat involves cybercriminals hijacking access to enterprise cloud services and LLMs and then reselling this access through underground subscription services. The implications for organizations could be severe, leading to exorbitant cloud charges that, in some instances, have surpassed $1 million before victims are even aware of the breach.
GTIG’s insights shed light on the operational mechanics of LLMjacking, revealing how cybercriminals can engineer costs that exceed $100,000 in a single day. Such staggering expenses arise from unauthorized access, where attackers exploit the resources of organizations that have become unwittingly embroiled in these malicious schemes. Piyush Sharma, co-founder and CEO of Tuskira, clarified the mechanics of these attacks, stating that “LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” highlighting the deceptive nature of these operations. The technology behind these crimes underscores the fragility of security measures when credentials can be reused across multiple models and applications.
The analysis conducted by GTIG encompassed various incidents in 2026, focusing on victims across North America, South America, and the Asia Pacific region. What became evident is the creation of a sophisticated underground business revolving around the theft of model access. Central to this illicit enterprise are LLM Mixers, which function as criminal routing gateways, aggregating stolen API credentials to resell model access to underground subscribers. These services adeptly proxy requests across stolen accounts, thereby obscuring the original source and shifting the financial burden onto the unsuspecting victim.
Among the myriad of operations identified, one infamous group, designated UNC6993, employed various techniques to pool stolen credentials and distribute requests. Tools such as "new-api" and "gcli2api" were reportedly used to aggregate keys, allowing attackers to execute commands and requests without drawing immediate attention to their actions.
Moreover, GTIG identified another operation that harnessed stolen third-party API keys to fuel a service named Jet Night. This legitimate token-routing service executed over 500,000 LLM API calls within a mere eight hours, costing the victim organization nearly $1 million in token expenses hidden under the guise of legitimate usage. Jet Night offers a tempting pitch of unlimited access to frontier models for approximately $60 per month, starkly undercutting the typical costs associated with authentic access to LLMs.
This alarming situation brings to the forefront the need for organizations to engage in proactive monitoring of their cloud costs. Nick Tausek, a lead security automation architect at Swimlane, highlighted the importance of early detection, stating, “Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important.” The essence of this threat is clear: by the time organizations begin to notice unusual spikes in their cloud expenditures, the attackers may already have secured their illicit profits.
The threat landscape presents a sobering reality where the initial stages of such attacks are meticulously planned well before the financial repercussions manifest. GTIG detailed how initial access typically occurs through exposed or stolen cloud identity tokens, such as IAM credentials, service account keys, and personal access tokens from repositories like GitHub. Attackers have displayed a remarkable ability to validate these stolen keys through minimal requests—often just a single token request—which remain beneath traditional detection thresholds.
Tausek warns about the subtle tactics employed by cybercriminals: “Testing a stolen key with a single-token request barely registers as consumption.” This seemingly innocuous activity can enable attackers to confirm the efficacy of stolen credentials before initiating any significant financial exploitation.
Once access is established, attackers often engage in a thorough exploration of cloud services, repositories, and data stores, cataloging further credentials and potentially escalating their privileges. In one observed incident, an attacker exploited a vulnerability in the LiteLLM gateway to elevate ordinary virtual keys into administrative credentials, showcasing the adaptive nature of these cybercriminals.
In light of these evolving threats, GTIG emphasizes the necessity for organizations to restrict credentials to their designated models and endpoints. Sharma advises that heightened attention must be paid to gateway compromises, as such vulnerabilities could amplify access beyond what was initially exploited.
To combat these threats, GTIG recommends implementing tighter credential management practices, enforcing least-privilege permissions, and deploying granular API key scopes. Monitoring for suspicious low-volume requests and setting spending limits on model consumption are further recommended safeguards. Additionally, organizations must remain vigilant in tracking unauthorized AI service enablements and addressing gateway vulnerabilities proactively.
As the landscape of cybercrime continues to evolve, the imperative for enterprises to enhance their security frameworks has never been more critical. Failure to act can not only result in financial losses but also compromise sensitive data, leading to a cascade of repercussions that could impact both the organization and its clientele.