Google: $1 Million in Fraudulent Cloud Charges via "LLMjacking" Attacks

Google's threat intelligence teams are warning that attackers are hijacking enterprise access to large language models and running up fraudulent cloud bills of as much as $1 million per organization, a tactic the company calls "LLMjacking." The warning was published by Google Threat Intelligence Group (GTIG) and Mandiant on Nov 2, 2026, in a report titled "The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources," and was reported the next day by The Hacker News (The Hacker News).

What was the specific vulnerability?

The core weakness is not a flaw in the models themselves but exposed or stolen cloud identity tokens: IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens that grant attackers direct access to expensive LLM APIs. According to the GTIG/Mandiant report (Google Cloud Blog), attackers also harvested LLM API keys from public GitHub repositories, validating each key with minimal single-token requests capped at max_tokens=1 to stay below the volume-anomaly thresholds that EDR and SIEM tooling watch for.

Mandiant incident responders documented a range of follow-on tradecraft across 2026 engagements. One actor paired a stolen GitHub PAT, which opened private code repositories, with exploitation of a suspected web application vulnerability in a containerized cloud environment. Another used compromised IAM credentials with cloud federation tokens to programmatically generate fresh access keys and circumvent multi-factor authentication. Post-access activity included enumerating cloud services for credentials, cloning codebases to extract hard-coded secrets, scanning access logs, harvesting secrets from cloud secret managers, creating backdoor service accounts disguised as internal billing optimization utilities, and injecting SSH keys for persistence. The report also documents exploitation of CVE-2026-40217 in LiteLLM, a widely used LLM routing library, to escalate privileges.

How was the incident detected?

The campaign was detected by GTIG and Mandiant incident responders across multiple 2026 incident response engagements, not by a single victim's report. The affected organizations span financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific.

One cluster, tracked as UNC6993, compromised a cloud instance in mid-2026 through a misconfigured Service Account key and then granted itself access to an LLM API. The same cluster hosted a session-hijacking page masquerading as an application portal, tricking users into pasting a raw JSON payload containing an active access token and thereby bypassing password and MFA controls. In a separate investigation, two distinct operational clusters coordinated to compromise and monetize the same enterprise LLM infrastructure, a division of labor the report presents as evidence that this activity is maturing into a repeatable business rather than opportunistic abuse.

What is the current impact?

Victims are paying the fraudulent consumption costs directly, with charges that scale far faster than comparable cloud abuse. "Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," the GTIG/Mandiant report states. The authors add: "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked."

Monetization happens through token proxying, automated model streaming, and GPU hardware provisioning, with some attackers hosting their own proxy endpoints and agentic workloads. A "burn and rotate" strategy of continuously creating and deleting short-lived service accounts helps bypass rate limits. GTIG also identifies a new actor category it calls "LLM Mixers": illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers. One such service, Jet Night (jet-night[.]com), advertises an unlimited token plan, which according to the report turns a single compromised enterprise key into a revenue stream for an entire underground customer base.

What are the next steps?

There is no patch to apply; remediation is operational and centers on identity hygiene. Organizations should revoke and rotate stolen tokens and keys, harden Service Account configurations, and close LLM endpoints exposed to the public internet. The report's findings imply that detection should focus on identity and billing anomalies, such as single-token API validation patterns, unexpected service account creation, and sudden spikes in model consumption, rather than on malware signatures alone. Because the initial access vectors are ordinary cloud credentials rather than novel exploits, the report's guidance places the burden on token lifecycle management: short-lived credentials, strict scoping of Service Account permissions, and monitoring of secret managers and code repositories for leaked keys.

By the numbers

• Fraudulent charges in a single day: more than $100,000 USD (GTIG/Mandiant, Nov 2, 2026)
• Cumulative charges at some organizations before access was revoked: up to $1,000,000 USD (GTIG/Mandiant, Nov 2, 2026)
• Named threat clusters: 1 (UNC6993)
• Actor categories: 2 (initial-access actors and "LLM Mixers")
• Coordinating clusters in one investigation: 2
• Sectors affected: 4 (financial services, retail, technology, transportation)
• Regions affected: 3 (North America, South America, Asia Pacific)
• Report publication: Nov 2, 2026; The Hacker News coverage: Nov 3, 2026

Source snapshot