Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.
Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure."
The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.
After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The service provider records the requests as legitimate consumption and charges the victim organization for the tokens.
GTIG and Mandiant observed an increase in this type of activity this year, with fraudulent charges exceeding $100,000 in a single day, and cumulative charges at some organizations reaching $1,000,000.
LLM mixers offer access to AI resources at very low prices, using their proxy infrastructure to relay customers' prompts to hijacked services through stolen API keys.
The researchers found several examples of such relaying infrastructure, including Jet Night, which sells “unlimited access plans” for $60/month, and the newapi[.]pro service.
“Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com,” Google says.
“Jet Night passed nearly one million dollars in token costs to the victim organization.”
Google also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums.
The attackers gain access via exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys.
Attackers search the compromised environment for credentials, logs, databases, and secret managers, and try to create backdoor accounts or inject SSH keys to maintain persistent access.
The researchers have also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows running arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.
In some cases, Google says that attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads.
"For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS," the researchers say.
Google recommends several actions to protect against LLMjacking attacks, which start with prioritizing Identity and Access Management (IAM) and securing the supply chain.
Companies should use centralized secrets platforms to enable the rotation and management of sensitive keys and secrets. Users should not have extended privileges unless required by their role and tasks.
"Deny all permissions that are not explicitly required, including access to Cloud LLM services," Google recommends.
Enforcing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility across the environment to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can help organizations detect LLMjacking attacks early, limit their impact, or prevent them altogether.
Furthermore, cloud audit and inference logs should be enabled and monitored for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.