Attackers hijacked enterprise access to cloud-hosted AI models in multiple 2026 incidents, generating fraudulent charges exceeding $100,000 in a single day and pushing costs to $1 million at some organizations before access was revoked, according to a report from Google Threat Intelligence Group and Mandiant.
The intrusions affected organizations in North America, South America and Asia-Pacific across financial services, retail, technology and transportation. The activity, known as LLMjacking, involves stealing access to large language model services and using or reselling victims’ compute and API quotas. Google said underground “LLM Mixers” route and resell unauthorized model access to subscribers.
Exposed or stolen cloud identity tokens were the most common entry point, including IAM credentials, service-account keys, GitHub personal access tokens and active session tokens. After gaining access, attackers searched repositories and cloud services for more credentials, created new service accounts and API keys, escalated permissions and used compromised infrastructure to maintain access. In some cases, they obtained infrastructure credentials, internal database passwords and third-party API keys from cloud secret managers.
The findings echo other developer-credential incidents, including the Gheist campaign that abused stolen GitHub tokens to extract repository secrets and the NVIDIA Brev incident in which unauthorized activity may have exposed customer SSH keys.
One tracked cluster, UNC6993, entered a cloud instance through a misconfigured service-account key, then used its access to enable an LLM API and quickly generated more than $100,000 in charges. In a separate incident, an operator used stolen third-party API keys to power Jet Night, a token-routing service that made more than 500,000 model calls in under eight hours and passed nearly $1 million in token costs to a victim.
Google also observed a follow-on actor exploiting a user-ID rebind flaw in LiteLLM’s /key/regenerate endpoint, tracked as CVE-2026-40217, to turn standard virtual keys into PROXY_ADMIN credentials. The report describes attackers combining stolen credentials, privilege escalation and cloud infrastructure abuse to monetize unauthorized access to commercial AI models.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
