Google Warns LLMjacking Attacks Rack Up $1 Million Cloud AI Bills

Enterprise cloud environments are facing astronomical bills as threat actors pivot from traditional resource hijacking to LLMjacking attacks, compromising foundation model access and incurring over $100,000 in daily compute charges. According to research released by the Google Threat Intelligence Group (GTIG) and Mandiant, these illicit activities can drain corporate cloud budgets within hours, with cumulative losses reaching $1 million for individual organizations before access is severed. Security teams are also seeing attackers exploit vulnerabilities such as CVE-2026-40217 in LLM infrastructure to gain initial footholds.

Unlike cryptojacking, which slowly siphons host CPU or GPU resources to mine cryptocurrency, LLMjacking directly leverages stolen application programming interface (API) keys, identity and access management (IAM) credentials, and exposed cloud endpoints to consume foundation model tokens at scale. Because cloud providers process these high-throughput inference requests as legitimate corporate usage, affected organizations bear the full financial burden of the consumed tokens.

How LLMjacking Operates: From Initial Access to Exploitation

The entry points for LLMjacking closely parallel traditional cloud breaches, but with a refined focus on secret harvesting and token exfiltration. Attackers scan public GitHub repositories for hardcoded API keys, target misconfigured service accounts, phish for active session tokens, and compromise developer environments to steal Personal Access Tokens (PATs) or temporary cloud credentials.

Once an attacker gains access to a target environment, they conduct rapid internal reconnaissance across cloud regions:

• Credential Harvesting: Searching application logs, code repositories, databases, and secret managers for secondary cloud keys.
• Exploiting LLM Middleware: Targeting vulnerabilities in AI routing and middleware infrastructure, such as CVE-2026-40217—a flaw in LiteLLM’s custom-code guardrail testing endpoint that allows arbitrary code execution on the server.
• Establishing Persistence: Generating backdoor IAM accounts disguised as internal billing utilities (e.g., “billing-optimization-service”), injecting SSH keys into compute instances, and abusing token-creation privileges attached to broad service accounts.
• Session Hijacking: Deploying malicious authentication portals. For instance, the threat actor group UNC6993 hosted a fake application portal that tricked users into submitting active access token payloads, allowing the group to bypass password and multi-factor authentication (MFA) protections to invoke backend LLM APIs.

To maintain continuous high-volume access without getting caught by basic rate limits, threat actors employ a “burn and rotate” strategy, continuously creating and deleting short-lived service accounts to pass traffic while avoiding simple pattern-based blocks.

The Underground Ecosystem: LLM Mixers and Reseller Services

The monetization model surrounding LLMjacking has matured into a structured division of labor between initial access brokers and downstream monetization infrastructure known as “LLM Mixers.” These mixers operate as gray-market routing gateways that aggregate stolen credentials and resell unauthorized AI model access at steep discounts via underground storefronts.

When an LLM mixer routes traffic through hijacked credentials, request volumes can instantaneously jump to over 1,000 requests per second. Researchers highlighted several key actors and services driving this marketplace:

• Jet Night (jet-night[.]com): An underground service offering “unlimited token access” plans for approximately $60 per month. In one observed incident, an attacker executed over 500,000 API calls in under eight hours using stolen third-party keys to power Jet Night, passing nearly $1 million in token costs to a single victim organization.
• D1337-KAIROS: An attacker persona that deployed custom Node.js proxy bundles and public reverse proxies inside compromised victim environments to host unauthorized proxy endpoints compatible with multiple frontier LLMs.
• Grey-Market CLI Relays: Analysis from Broadcom’s Symantec and Carbon Black revealed an active relay network operating in regions where Western AI vendors do not directly operate, including Mainland China, South Korea, Taiwan, and Malaysia. Attackers trick developers into running fileless setup scripts (vibe.aiok[.]me) after installing genuine OpenAI Codex or Anthropic Claude Code CLIs. The script modifies configuration files (~/.codex/config.toml or ~/.claude/settings.json), disables security sandboxing (such as setting Codex to danger-full-access), replaces legitimate credentials with relay tokens, and reroutes all prompts through third-party proxy servers.

Detection and Remediation Guidance

Mitigating LLMjacking requires shifting from traditional host-centric detection to strict identity boundaries, infrastructure patching, and API budget governance:

1. Enforce Hard API Spend Limits: Configure strict daily usage caps, hard spend limits, and automated rate limiting across cloud providers (such as Google Cloud Vertex AI, AWS Bedrock, or Azure OpenAI) and third-party AI endpoints. Ensure billing alerts automatically revoke key permissions upon reaching defined cost thresholds rather than relying solely on asynchronous email notifications.
2. Patch AI Gateway Software: Immediately update LiteLLM deployments to a patched version that resolves CVE-2026-40217 and disable unnecessary custom-code testing endpoints.
3. Audit IAM and Service Account Permissions: Restrict cloud service accounts using strict least-privilege principles. Explicitly deny foundation model and LLM invocation permissions (llm:* or equivalent) to all accounts except those with a strictly validated operational need.
4. Centralize and Rotate Secrets: Remove hardcoded API tokens from source code and environment configurations. Mandate the use of centralized secret managers paired with automated rotation policies.
5. Monitor Developer Configurations and Telemetry: Enable detailed cloud audit and inference logging. Monitor local developer systems for unauthorized configuration modifications to OpenAI Codex (~/.codex/config.toml) or Claude Code CLI (~/.claude/settings.json), and monitor network logs for connections to known relay domains like vibe.aiok[.]me or jet-night[.]com.