LLMjacking cloud bills are now a treasury risk for enterprises running large language models in production. On November 2, 2026, Google Threat Intelligence Group and Mandiant detailed multiple 2026 incidents in which attackers stole cloud and model credentials and resold that access through underground LLM Mixers. In financial services, retail, technology, and transportation across North America, South America, and Asia Pacific, fraudulent charges exceeded $100,000 in a single day, and some cumulative bills reached $1 million before access was revoked.
Key Takeaways
- 2026 LLMjacking incidents produced bills exceeding $100,000 in a single day.
- Some cumulative fraudulent charges reached $1 million before access was revoked.
- LLM Mixers resell stolen model access; one plan advertised approximately $60 a month.
- Single-token checks stayed undetected by EDR and SIEM volume-anomaly alerts.
Why LLMjacking Cloud Bills Spike Within Hours
Unlike cryptojacking, which drains resources gradually, LLMjacking can produce large charges in a matter of hours. Each unauthorized inference call is billed as ordinary use. BleepingComputer, citing the investigation, reported resold traffic sometimes exceeding 1,000 requests per second, still recorded as legitimate consumption.
eWeek noted the findings do not establish that criminals are using compromised accounts to conduct attacks against the same organizations paying for those resources. The loss can be the meter itself.
| Exposure | Figure |
|---|---|
| Single-day fraudulent charges | Exceeding $100,000 |
| Cumulative charges before revocation | Reaching $1 million |
| Jet Night calls in under eight hours | More than 500,000 |
| Token costs passed to one victim | Nearly $1 million |
| Jet Night unlimited plan | Approximately $60 a month |
How Stolen Credentials Reach Enterprise AI
Attackers bypassed front-end chatbot interfaces and targeted backend model resources: public LLM endpoints or valid API keys. The dominant path was exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. They also harvested corporate LLM keys from public GitHub repositories and scanned for exposed Ollama endpoints, trying to register their own models.
Cluster UNC6993, in mid-2026, used a misconfigured service account key to reach an LLM API. UNC6993 also hosted a session-hijacking page masquerading as an application portal. The page tricks users into pasting a raw JSON payload containing an active access token, which was then posted to a backend API, bypassing passwords and MFA.
Separate intrusions combined a stolen personal access token with a suspected flaw in a containerized application, or minted fresh keys with federation tokens to circumvent MFA. Viability checks used single-token requests set to max_tokens=1 and remained undetected by EDR and SIEM volume-anomaly alerts.
How LLM Mixers Resell Stolen Model Access
GTIG is tracking a split between actors who steal access and operators of LLM Mixers, gateways that proxy, aggregate, and resell it. In one investigation, two clusters coordinated both stages. Stolen keys powered Jet Night, a token-routing service CSO Online described as legitimate, advertising unlimited frontier-model access for approximately $60 a month.
That report cited more than 500,000 calls in under eight hours and nearly $1 million in token costs shifted to the victim. GTIG suspects related outages followed victims revoking keys. UNC6993 accumulated over $100,000 in billing charges after enabling services and minting more API keys.
LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize.
Piyush Sharma, co-founder and CEO at Tuskira, said that in comments reported by CSO Online. “A key issued for one application shouldn’t become a reusable pass to other models and workloads.”
Inside victim environments, actors hunted repositories, logs, and warehouse metadata for further secrets. Google also observed object-storage operations associated with targeted data theft and exfiltration of credentials from secret managers.
Persistence included unauthorized IAM accounts, injected SSH keys, and deceptive backdoor service accounts disguised as internal billing optimization utilities. A follow-on cluster used CVE-2026-40217, a user-ID rebind flaw in LiteLLM’s /key/regenerate endpoint, to elevate virtual keys to PROXY_ADMIN.
TechRadar, quoting Google, also described a burn-and-rotate pattern of short-lived service accounts and, separately, proxy workloads rebranded as D1337-KAIROS.
What Security and Finance Should Lock Down
Google’s guidance, echoed in the coverage, pairs least privilege with spend visibility. The boundary question in blocking external AI agents from internal systems applies to model keys as well. An unexplained spike that fails a check of usage against intended outcomes is a security event, not only a budget variance.
- Deny unneeded Cloud LLM permissions and scope each key to specific models and endpoints.
- Keep keys out of public repositories and rotate them in a centralized secrets store.
- Require phishing-resistant MFA and review who can enable AI services or mint keys.
- Alert on single-token checks, new admin rights, unauthorized enablement, and logging cuts.
- Set usage and spending caps, and revoke credentials as soon as compromise is suspected.
“By the time someone asks why the cloud bill has exploded, the attacker may already have paying customers,” said Nick Tausek, lead security automation architect at Swimlane, in comments reported by CSO Online.
“Testing a stolen key with a single-token request barely registers as consumption,” he said. “But pair that request with a newly created credential or an unexpected permission change, and there’s something worth investigating.”
