Large-scale LLM hijacking attacks are driving fraudulent cloud bills of more than $100,000 per day for some organizations, with cumulative costs reaching $1 million. Researchers from Google’s Threat Intelligence Group (GTIG) and Mandiant say attackers are stealing cloud and AI credentials, reselling access through “LLM mixers,” and using compromised infrastructure to route unauthorized requests to large language models.
How LLM jacking attacks work
GTIG and Mandiant identified “two distinct operational clusters working together to compromise and monetize enterprise LLM infrastructure.” The researchers observed two primary categories of attackers: those scanning publicly available LLM endpoints and those stealing valid API keys from unprotected machines.
After obtaining access, attackers sell it to services known as LLM mixers. These services provide subscribers with unauthorized access to large language models by routing their prompts through compromised accounts and infrastructure.
Request volumes can suddenly exceed 1,000 requests per second after access is resold. Because the requests are made through valid credentials, the AI service provider records the activity as legitimate consumption and bills the victim organization for the generated tokens.
Source: Google
GTIG and Mandiant have observed an increase in this activity this year. Fraudulent charges have exceeded $100,000 in a single day, while the cumulative cost has reached $1 million for some organizations.
Stolen keys fuel low-cost AI services
LLM mixers use proxy infrastructure to relay customer prompts to hijacked services through stolen API keys. This allows subscribers to access AI resources at a fraction of the normal cost.
Researchers identified several examples of this transit infrastructure, including Jet Night and newapi, which offer “unlimited access plans” for $60 per month.
“Another attacker, who made over 500,000 LLM API calls within eight hours, used stolen third-party API keys to power the token routing service Jet-night.com,” Google says.
“Jet Knight passed nearly $1 million in token costs to victim organizations.”
Source: Google
Attackers target cloud credentials and LLM platforms
Google also identified a threat cluster known as UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests. The group may also sell access through underground forums.
Attackers obtain access through exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys. Once inside an environment, they search for credentials, logs, databases and secret managers. They may also create backdoor accounts or inject SSH keys to preserve access.
Researchers observed attackers exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows arbitrary code execution on a server by abusing a custom code guardrail test endpoint.
In some cases, attackers used victims’ cloud infrastructure to host unauthorized proxy endpoints and agent workloads.
“For example, one attacker enabled an agent, deployed a publicly accessible reverse proxy, and used a custom Node.js proxy bundle to expose multiple Frontier LLM-compatible endpoints rebranded under a persona known as D1337-KAIROS,” the researchers said.
Google’s recommendations for preventing LLM jacking
Google recommends prioritizing identity and access management (IAM) and securing the software supply chain to reduce the risk of LLM hijacking.
Organizations should use a centralized secrets platform to manage and rotate sensitive keys and credentials. Access should follow the principle of least privilege, with users denied permissions that are not explicitly required, including access to cloud-based LLM services.
Google also recommends enforcing phishing-resistant multifactor authentication (MFA), improving monitoring visibility across the environment, and identifying unauthorized LLM and AI services, often referred to as shadow AI.
API usage and spending limits can help detect suspicious activity early and restrict the financial impact of an attack. Cloud audit logging and inference logging should also be enabled and monitored for unauthorized service activations, suspicious credential checks, unusual usage patterns and attempts to disable logging.
Source: www.bleepingcomputer.com