What is LLMjacking? How stolen AI access is resold and how to defend your accounts

LLMjacking means stealing access to a hosted language model and using it on the victim's bill. The word echoes cryptojacking, where attackers hijack servers to mine coins. On November 2, 2026, Google's Threat Intelligence Group and Mandiant published a report saying the AI version is growing. This explainer covers what it is, how it works and what to switch on before it happens to you.

What LLMjacking is

An attacker obtains a valid credential for a cloud AI service: a cloud identity token, a service account key, a GitHub personal access token or a plain model API key. They then call the model as the victim. The provider records the traffic as legitimate, so the victim pays for the tokens, according to BleepingComputer's summary of the report.

Google's authors describe the difference from cryptojacking plainly: "Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours."

The scale, in numbers

Google says Mandiant responded to multiple 2026 incidents across North America, South America and Asia Pacific, affecting financial services, retail, technology and transportation. Across individual incidents, fraudulent charges exceeded $100,000 in a single day. At some organizations the cumulative total reached $1 million before access was cut off. That is a worst case, not a typical loss.

One case shows the speed. A single threat actor made more than 500,000 API calls in under eight hours through a token service called jet-night.com, passing nearly $1 million in token costs to the victim. Another group tracked as UNC6993 accumulated over $100,000 in billing charges.

How the attacks work

Google breaks the chain into four steps.

• Initial access. The dominant vector is exposed or stolen cloud identity tokens. Attackers also harvest model API keys from public GitHub repositories and target publicly exposed model endpoints. One actor used a page that tricked users into pasting raw JSON containing an active access token, bypassing password and MFA controls.
• Movement and persistence. Attackers search repositories, logs and secret managers for more credentials, create unauthorized accounts, attach administrator policies and inject SSH keys. One exploited a flaw in the LiteLLM proxy tracked as CVE-2026-40217.
• Monetization. They enable managed model services, create more API keys, subscribe the account to pay-as-you-go plans and run high-volume inference. A "burn and rotate" tactic creates and deletes short-lived service accounts to dodge rate limits.
• Evasion. Validation sweeps use minimal requests, such as max_tokens=1, to confirm a stolen key works without tripping volume alerts.

The resale market: LLM mixers

The report describes a division of labor between actors who gain initial access and operators who run the downstream business, known as LLM mixers. These are illicit gateways that pool stolen keys and sell access to buyers. Google lists jet-night.com and newapi[.]pro as indicators. Jet Night advertised an unlimited token plan for about $60 a month, against an estimated $100 to $250 a month for a comparable consumer service. Google reasons that "Given Jet Night's per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably."

It is not only a cloud-customer problem

The vendors that sit between you and the model are targets too. Fireworks AI, which hosts open models, says the evidence from its October 2026 incident links to a financially motivated group that sells unauthorized LLM access, the same practice. Our report on the Railway breach covers another case in which stolen keys produced fraudulent usage.

How to defend

Google's recommendations are practical and cheap compared with a $100,000 day.

• Least privilege. Deny every permission not explicitly required, including access to cloud model services. Segment API keys by model, environment and usage limit.
• Secrets hygiene. Use a central secrets manager, rotate automatically and scan repositories for keys.
• Phishing-resistant MFA across cloud consoles, identity providers and developer platforms.
• Spending controls. Set budget alerts, spending caps and per-model quotas.
• Alert on enablement. Treat any unauthorized enabling of a model service as a critical event, and any attempt to disable logging by a non-infrastructure-as-code principal as high severity. Note that on Google Cloud, Data Access logs needed for inference visibility are disabled by default.
• Patch gateways. Update proxies such as LiteLLM promptly.
• Hunt for shadow AI. Look for models and endpoints nobody approved.

What we do not know

Google's numbers come from incidents Mandiant handled, which skews toward large victims. They do not measure the whole market, and the report does not say how many small accounts are hit. The share of attacks that start at AI vendors versus customers is also unclear.

Why AI access is such an attractive target

Three features of the report explain the economics. First, the traffic looks legitimate. BleepingComputer's summary notes that the cloud provider records the traffic as valid, so the victim is billed for the tokens, and that request volumes sometimes exceed 1,000 requests per second. Second, the resale price is low enough to attract buyers: a $60 monthly unlimited plan against a $100 to $250 market estimate. Third, attackers can scale without owning hardware. Google describes actors provisioning GPU instances and requesting quota increases through the cloud APIs, and using victims' infrastructure to host unauthorized proxy endpoints and agentic workloads.

The logs worth watching

Google lists the specific events defenders should alert on. On AWS, they include calls such as InvokeModel and Converse to the Bedrock service, plus deletion of model invocation logging configuration. On Azure, they include writes to cognitive services deployments and deletion of diagnostic settings. On Google Cloud, they include enabling services through Service Usage and calls to prediction and content generation endpoints. The report adds that automated tools and SDKs interacting directly with cloud infrastructure, identified by user agent, deserve a flag.

Our take

LLMjacking is a billing problem wearing a security costume, and the first line of defense is the same as for any metered cloud service: tight permissions and a hard cap. If your team has ever pasted a model key into a repository, a chat or an environment variable that a vendor can read, rotate it today. We would watch for providers to make spending caps the default rather than an option.