Google and Mandiant Report LLMJacking: Stolen Cloud Tokens and API Keys Turn Enterprise Model Access Into Bills Above $100,000 a Day in Some Incidents

On November 2, 2026, Google Threat Intelligence Group and Mandiant published a report on LLMJacking, the hijacking of an organization's access to large language models. The report says Mandiant responded to multiple incidents in 2026 in which threat actors took over enterprise access to LLMs across a variety of cloud and model providers. The victims were in North America, South America and Asia Pacific, in financial services, retail, technology and transportation. The authors describe a pattern, not a single campaign, and they build it from several separate investigations.

The money is the main point. Unlike the slow resource use of cryptojacking, LLMJacking can produce a large spike in fraudulent cloud charges within hours. The report says that across individual incidents, fraudulent charges exceeded 100,000 dollars in a single day, and that at some organizations cumulative charges reached 1 million dollars before access was revoked. These are figures from selected incidents that Mandiant handled, not an average and not a total for the industry.

On initial access, the report says attackers bypass front-end chat interfaces and go after backend model resources directly. They look for publicly exposed LLM endpoints, or for valid API keys. Across multiple investigations, the dominant way in was exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One cluster, tracked as UNC6993, used a misconfigured service account key in mid-2026, and also hosted a fake portal that told users to paste a raw JSON payload holding an active access token, which could bypass passwords and multi-factor authentication. Another actor harvested corporate LLM API keys from public GitHub repositories and checked them with single-token requests, using max_tokens set to 1, so that endpoint detection and volume alerts did not fire.

Once inside, the actors moved to widen and keep access. The report describes creating unauthorized IAM and service accounts, attaching administrative policies, and injecting SSH keys into compute instances. It also describes an attack on LLM routing software. After obtaining pre-validated virtual keys, a follow-on cluster used a user ID rebind flaw in the /key/regenerate endpoint of a LiteLLM gateway, tracked as CVE-2026-40217, to turn ordinary virtual keys into full proxy administrator credentials. The report treats the gateway itself as something to patch like any other privileged system.

The abuse stage is about turning access into money. Actors enabled managed generative AI services that were not turned on at the time of compromise, created more API keys, and in one case subscribed victim accounts to pay-as-you-go plans and ran high-volume inference with a burn-and-rotate pattern of short-lived service accounts. The report also describes LLM Mixers, which are illicit gateways that pool, meter and resell stolen access to underground subscribers. One service, Jet Night, drove more than 500,000 API calls in under eight hours and passed nearly 1 million dollars in token costs to a victim. GTIG believes it relies on stolen keys because it advertises an unlimited plan for about 60 dollars a month for models that would normally cost 100 to 250 dollars, and because it posts outages that likely follow key revocations. Those are GTIG's inferences, not proven facts.

For defenders, the report gives layered advice. Treat any unauthorized enabling of an LLM service as a critical security event, since in several incidents the service was off at the time of compromise. Use central secrets management and automated secret scanning, least privilege that denies access to LLM services unless needed, phishing-resistant multi-factor authentication, network allowlists, rate limiting, granular API quotas and spending caps, and key scopes that separate cheap utility models from expensive frontier models. Watch gateway and API logs for tiny validation requests, patch model gateways quickly, and restrict model pulls to vetted registries. The report also lists Google Security Operations rule names, such as account key creation and project SSH key changes, that detect parts of the activity.

Read the numbers with care. The incidents are a selected set seen by one responder, and several attributions are the authors' assessments. The outlook, that GTIG expects LLMJacking to be prioritized over cryptojacking, is a forecast. The practical step is cheap: confirm today which of your cloud accounts can enable model services, set a hard budget cap and alert on any new model enablement, and rotate any API key that has ever appeared in a repository.