Some organizations have faced fraudulent cloud charges of more than $100,000 in a single day, with cumulative charges at some reaching $1 million, from LLMjacking attacks that can involve stolen API keys to run large language model workloads, researchers at Google's Threat Intelligence Group and Mandiant report.
The researchers said they observed “two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.” They also identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines. They observed an increase in this type of activity this year.
After gaining initial access, the attackers sell it to services known as LLM mixers, which offer subscribers low-cost access to AI resources by relaying prompts to hijacked services through stolen keys. Once the access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The service provider records the requests as legitimate consumption and charges the victim organization for the tokens.
Google named Jet Night, which sells "unlimited access plans" for $60 a month, and the service newapi[.]pro as examples of the relaying infrastructure. "Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com," Google said. "Jet Night passed nearly one million dollars in token costs to the victim organization."
The report also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access through underground forums. Initial access comes through exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys. Attackers then search the compromised environment for credentials, logs, databases and secret managers, and try to create backdoor accounts or inject SSH keys to maintain persistent access.
Researchers also observed exploitation of CVE-2026-40217, a vulnerability in LiteLLM that allows arbitrary code execution on the server through the custom-code guardrail testing endpoint. Google said that in some cases, attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads. “For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS,” the researchers said.
Google recommends prioritizing Identity and Access Management and securing the supply chain, using centralized secrets platforms to rotate and manage sensitive keys, and limiting privileges to what each role and task requires. “Deny all permissions that are not explicitly required, including access to Cloud LLM services,” Google recommends. It also urges phishing-resistant multi-factor authentication, monitoring for unauthorized LLM and AI services, setting API usage and spending limits, and enabling cloud audit and inference logs.
Analysis
Why This Matters
- A single stolen API key can be resold to many subscribers, letting attackers burn through a victim's cloud credit in hours: one campaign executed more than 500,000 LLM API calls in under eight hours.
- The attacks prey on common operational weaknesses, including exposed endpoints, unprotected credentials and over-broad permissions, so the defenses Google lists are largely within an organization's own control.
- Cloud AI bills grow automatically with usage, meaning fraudulent traffic is billed as legitimate consumption until someone spots it, which makes monitoring and spending limits the key safeguards.
Background
LLMjacking is the hijacking of large language model infrastructure: attackers steal API keys or find exposed LLM endpoints, then resell the access through LLM mixers at cut prices. Providers bill the legitimate account holder for all traffic, so the theft surfaces as unexpectedly large cloud invoices. Google's Threat Intelligence Group and Mandiant analyzed incidents showing the practice increasing this year.
What to Watch
- Whether exploitation of the LiteLLM vulnerability CVE-2026-40217, which allows arbitrary code execution on servers, spreads to more targets.
- Whether the named infrastructure, Jet Night and newapi[.]pro, and clusters such as UNC6993 and the D1337-KAIROS persona, appear in further incident reports.
- Whether organizations act on Google's advice to set API usage and spending limits, which the researchers say can detect, limit or prevent attacks early.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedLLMjacking attacks can generate up to $1 million in cloud AI charges, according to Google researchers.BleepingComputer: “Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.”
- SupportedJet Night passed nearly $1 million in token costs to a victim organization.BleepingComputer: ““Jet Night passed nearly one million dollars in token costs to the victim organization.””
- SupportedAttackers resell access through services known as LLM mixers.BleepingComputer: “After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.”
- SupportedSome organizations have faced fraudulent cloud charges exceeding $100,000 in a single day.BleepingComputer: “observed an increase in this type of activity this year, with fraudulent charges exceeding $100,000 in a single day”
- SupportedCumulative fraudulent charges at some organizations have reached $1 million.BleepingComputer: “cumulative charges at some organizations reaching $1,000,000.”
- SupportedResearchers observed “two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.”BleepingComputer: ““two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure.””
- SupportedResearchers identified two categories of threat actors: those scanning for exposed LLM endpoints and those stealing valid API keys from unprotected machines.BleepingComputer: “The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.”
- SupportedResearchers observed an increase in this type of activity this year.BleepingComputer: “observed an increase in this type of activity this year”
- SupportedRequest volumes can sometimes exceed 1,000 requests per second after access is resold.BleepingComputer: “Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second.”
- SupportedJet Night sells unlimited access plans for $60 a month.BleepingComputer: “including Jet Night, which sells “unlimited access plans” for $60/month”
- SupportedGoogle said a threat actor made more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys to power jet-night.com.BleepingComputer: ““Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com,” Google says .”
- SupportedA threat actor enabled agents, deployed public reverse proxies and used custom Node.js proxy bundles to expose endpoints for multiple frontier LLMs under the D1337-KAIROS persona.BleepingComputer: “"For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS," the researchers say.”
