When attackers stole cloud credentials a few years ago, the usual next step was cryptojacking: they quietly ran cryptocurrency miners on the victim's compute and hoped nobody looked at the bill for a while. New research from Google suggests the criminal market has moved on to something that costs victims far more, and much faster.

On Nov. 2, Google Threat Intelligence Group (GTIG) and Mandiant published research on what they call "LLMJacking": taking over an organization's access to large language models (LLMs) in the cloud and selling it on. Mandiant says it responded to several of these incidents in 2026. In some of them, fraudulent charges topped $100,000 in a single day. The total at some victims reached as much as $1 million before the access was shut off.

Here is what the research says, how the business model works, and what defenders should check.

What exactly is LLMJacking?

Companies that build on commercial AI models usually pay by usage. They are billed for tokens, the small chunks of text a model reads and writes, through API keys or cloud service accounts. Whoever holds a working key can run up charges that land on the key owner's bill. LLMJacking means stealing that access and spending it.

The economics are what separate it from cryptojacking. Cryptojacking consumes a victim's resources gradually. According to GTIG, LLMJacking spikes happen within hours. A stolen key can be hit with a huge number of automated requests in a short time. In one case described in The Register's coverage, an intruder made more than 500,000 LLM API calls in under eight hours using stolen third-party keys. The Register also points to an August CrowdStrike report that described one token thief sending about 200,000 requests in two minutes.

Who is being hit?

According to Help Net Security's summary of the Mandiant findings, the incidents involved companies in financial services, retail, technology and transportation, across North America, South America and Asia Pacific. Nothing in that list points to a single sector or region. Any organization with live, paid access to cloud AI models is a potential target.

How does the criminal supply chain work?

GTIG describes a division of labor. One set of financially motivated clusters handles initial access: getting into cloud environments and taking LLM credentials. A second layer, which GTIG calls "LLM Mixers," proxies, aggregates and resells that unauthorized access to paying customers. The customers may never touch a victim's environment directly. They just buy cheap AI access, and stolen keys sit behind it.

Help Net Security reports three ways the stolen access is turned into money:

  • Token proxying: passing other people's requests through stolen keys and charging them for it.
  • Automated model streaming: running heavy volumes of automated model output through compromised accounts.
  • GPU hardware provisioning: using the victim's cloud account to spin up expensive GPU resources.

Jet Night: a reseller with an outage page

The best-documented example in the research is a service called Jet Night. According to The Register, the 500,000-call, eight-hour spree was carried out to power Jet Night. The service sells an "unlimited" plan for about $60 a month. Comparable legitimate access costs roughly $100 to $250 a month. GTIG concludes that prices that far below market mean the service relies on stolen keys to operate profitably.

Help Net Security reports that Jet Night has announced several outages on its Telegram channel. Researchers think these likely line up with victims finding and revoking the stolen keys behind the service. One victim was left with nearly $1 million in token costs. In other words, the reseller's downtime notices track, at least roughly, the moments when someone else's breach was cleaned up.

What tactics did the attackers use?

The Register describes two patterns from Mandiant's casework that matter for detection.

The first involves a cluster Google tracks as UNC6993. After getting LLM API keys, UNC6993 did not just use them. It created more keys and turned on additional services inside the victim's environment, running up about $100,000 in charges. Creating extra keys is a persistence move. Revoking the one key you know about may not end the abuse if the attacker has already made others.

The second is a "burn and rotate" approach built on short-lived service accounts. According to The Register, the actor created and deleted short-lived service accounts to bypass rate limits while watching the billing interface to gauge the financial impact. Each identity lives only briefly, so alerting tied to a single known-bad account has less to catch, and cleanup becomes a moving target.

The sources do not attribute any of this activity to a nation-state. GTIG describes the clusters it tracks as financially motivated.

What It Means for Defenders

Who is affected: any organization that pays for cloud-hosted LLM access through API keys or service accounts. That includes access bought directly from a model provider and access through a cloud platform's AI services. Mandiant's cases covered four industries across North America, South America and Asia Pacific, so this is not a niche risk. The Jet Night case also involved stolen third-party keys. If your vendors or integrations hold AI credentials for you, those count as part of your exposure.

There is no CVE to patch in the core pattern. This is credential abuse, not a software flaw, so the defenses come down to identity, monitoring and billing hygiene. The sources do not publish a formal mitigation checklist for these exact steps. The list below follows from the attacker behavior they describe, and reflects the general guidance The Register relays: prioritize identity and access management, rotate keys through centralized secrets management, apply least privilege, and scan code for embedded keys.

  • Watch spend on an hourly scale, not a monthly one. GTIG stresses that LLMJacking costs spike within hours, so a monthly invoice review will come too late. Set budget alerts and usage thresholds on AI services that fire fast enough to stop a six-figure day.
  • Inventory every LLM key and service account. UNC6993 generated new keys after getting in. When you respond, list all keys and service accounts tied to AI services and look for any created recently or by unexpected identities. Don't stop at revoking the one you know was leaked.
  • Alert on newly enabled services. Help Net Security reports that in several incidents Mandiant investigated, AI services had been switched off and the attackers used stolen access keys to turn them on. Turning on an AI or GPU service in an account that has never used one deserves a look.
  • Look for short-lived service accounts. The "burn and rotate" tactic leaves a pattern: service accounts that are created, used heavily and dropped soon after. Monitor service-account creation and deletion, not only activity on accounts you already know.
  • Watch request volume, not just cost. Hundreds of thousands of calls in hours, or about 200,000 in minutes as in the CrowdStrike case The Register cites, is not normal application traffic for most organizations. Rate anomalies on model endpoints are an early warning.
  • Include GPU provisioning in your monitoring. One of the monetization routes Help Net Security lists is provisioning GPU hardware in victim accounts. Unexpected GPU instances should trigger the same response as an unexpected token spike.
  • Scan code for embedded keys. Help Net Security notes one group harvested API keys from public GitHub repositories and tested them with tiny requests too small to trip the victim's alerts, so automated secrets scanning matters.
  • Review third-party key custody. Since stolen third-party keys powered Jet Night, ask vendors and integration partners how they store and rotate the AI credentials they hold for you.

For organizations working through CMMC or similar frameworks, it may help to treat AI service credentials as the same class of asset as any other privileged cloud credential, inside the same access-control and audit-logging scope. In practice, an LLM key is a credit card number with an API attached.

Sources