The bill can arrive within hours of the compromise
Cryptojacking stole compute slowly, and victims often found it in a capacity review. LLMjacking bills differently. In the incidents Mandiant responded to this year, attackers took stolen cloud credentials or API keys, enabled model services that were not active at the time of compromise, and ran them at volume. Google's report puts the observed damage at more than $100,000 of fraudulent charges in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked.
Read the wording the way the report wrote it. These are figures from individual incidents. Google does not publish the total number of incidents it investigated, or an average or median loss. The report establishes that individual compromises can generate six-figure daily charges and, in some cases, cumulative costs approaching $1 million before access is revoked. It does not establish how frequently that happens or what a typical compromise costs.
The keys are the product now
The entry routes are unglamorous. The dominant vector across the investigations was exposed or stolen cloud identity tokens — IAM credentials, Service Account keys, GitHub personal access tokens, live session tokens. One cluster, tracked as UNC6993, entered through a misconfigured Service Account key in mid-2026, then ran a fake portal page that talked users into pasting the raw JSON of an active session token, bypassing passwords and multifactor authentication in one step. Another actor harvested corporate LLM API keys from public GitHub repositories and tested them with minimal single-token requests (max_tokens=1). GTIG says the technique allowed the group to confirm that stolen keys worked while remaining undetected by the victim's endpoint detection and response and SIEM volume-anomaly alerts.
Once inside, the scaling steps are the ones that turn a leak into a six-figure day. Attackers created additional API keys, enabled model services that were off at the time of compromise, subscribed victim accounts to pay-as-you-go agreements for premium models, and in one case rotated short-lived service accounts while watching the victim's own billing console to track the damage. A follow-on cluster escalated through the victim's LiteLLM gateway, exploiting a user ID rebind vulnerability in its /key/regenerate endpoint. According to Google, the flaw allowed standard Virtual Keys to be elevated into full PROXY_ADMIN credentials, giving the attackers administrative control over the gateway.
Sixty dollars a month, a million dollars a victim
The part of the report that changes the economics is the resale layer. Google describes "LLM Mixers": gateways that pool stolen credentials, meter usage and hide where requests originate, so the person running the prompts is no longer the person holding the keys. In one investigation, two separate clusters split the work — one compromised the infrastructure, the other monetized it.
The clearest example is a routing service called Jet Night. An actor feeding it stolen third-party keys made more than 500,000 API calls in under eight hours, and the service passed nearly $1 million in token costs to a single victim organization. Jet Night sells an unlimited plan for about $60 a month, claiming frontier model access. GTIG's comparison is telling: a legitimate consumer service offering a comparable level of access would typically cost $100 to $250 a month, according to the group. GTIG believes Jet Night relies on stolen keys to make its approximately $60 unlimited plan economically viable. That is the group's assessment of the business model, not an independently verified account of the service's finances. The service's own Telegram channel has advertised outages, which Google reads as the sound of keys being revoked as victims catch on.
The intermediary changes the economics of the theft. Customers buy access through the gateway, while the underlying API consumption is charged to the compromised organization's account. GTIG's investigation shows how the mixer can separate the person consuming the tokens from the account paying for them.
What Google asks defenders to do first
The report's guidance starts earlier than detection. Treat any unauthorized enablement of an LLM service as a critical security event. In multiple investigations, Mandiant found that LLM services were not enabled when the attackers gained access; compromised credentials allowed them to activate the services and begin generating substantial bills within minutes or hours. Scope API keys to specific models and environments, enforce per-model quotas and spending caps, and monitor for small signals: one-token validation requests, API keys created outside normal processes, and services enabled by identities that have never used them before.
What is new is the clock. GTIG expects threat actors to increasingly prioritize LLMjacking over traditional resource theft such as cryptojacking. Its reasoning is economic: compromised model access can be monetized quickly through emerging resale gateways, while the resulting cloud charges are passed to the victim before the compromise is detected.
Sources
- [1] Google Cloud Threat Intelligence Group / Mandiant, "The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources", November 2, 2026 (read first-hand — all figures in this article, the UNC6993 case, the LLM Mixer resale layer, Jet Night's roughly $60 plan and the 500,000 calls in under eight hours, the outlook, and the detection and mitigation guidance). Google's report identifies the LiteLLM flaw described in this article as CVE-2026-40217; the public advisory under that identifier describes a different LiteLLM issue.Read source
- [2] The Register, "Token thieves costing companies $100K+ per day in illicit LLM charges", November 2, 2026 (cross-check of the $100K/day and $1M figures and the Jet Night case)Read source
- [3] SiliconANGLE, "Google finds 'LLMjacking' attackers running up $100K a day in fraudulent cloud charges", November 2, 2026 (cross-check of scope: victims in financial services, retail, technology and transportation)Read source