# LLMJacking: Criminals Hijack Corporate API Keys for Massive Token Theft Organizations face daily losses exceeding $100,000 as threat actors exploit stolen LLM credentials. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/20c7dd0c-7d86-405e-8a90-c02b6b5f6275 ## The Rise of LLMJacking Criminals are increasingly hijacking corporate LLM access to steal expensive computing resources. This tactic, known as LLMJacking, has steadily risen over the past two years. Victim organizations report cumulative charges reaching $1 million before access is revoked. Attackers prioritize this method to gain a scale advantage over defenders using agentic tools. ## Financial Impact of Theft Fraudulent resource consumption can exceed $100,000 per day for a single victim. In one documented incident, threat group UNC6993 gained access to API keys and enabled services within cloud projects to rack up these massive charges. Attackers often subscribe victim accounts to pay-as-you-go agreements to access premium foundation models. ## Burn and Rotate Strategy Attackers utilize a burn and rotate strategy to bypass rate limits by creating and deleting short-lived service accounts. They monitor the billing interface to track financial impact while launching high-volume inference streams. This method allows them to maintain profitability while avoiding detection by standard security monitoring tools for extended periods. ## Jet Night Service Operations A token routing service called Jet Night executed over 500,000 API calls in less than eight hours using stolen keys. By offering unlimited tokens for $60 per month, they undercut market rates significantly. Frequent outages reported on their Telegram channel suggest that victims are successfully revoking stolen keys, disrupting their operations. ## Division of Criminal Labor The LLMJacking ecosystem now features a division of labor between initial access brokers and those managing monetization infrastructure known as LLM Mixers. In a mid-2026 incident, UNC6993 compromised a cloud instance through a misconfigured service account key. They then used this access to grant further permissions to a model API. ## Session Hijacking Techniques Criminals deploy session hijacking pages that mimic legitimate application portals to deceive users. These pages trick victims into pasting raw JSON payloads containing active access tokens. This method effectively bypasses password and multifactor authentication controls, allowing attackers to gain direct backend API access without triggering standard security alerts or login warnings. ## Shift from Cryptojacking Google predicts that miscreants will increasingly prioritize LLMJacking over traditional resource theft methods like cryptojacking. The high demand for frontier models makes stolen API access more lucrative and scalable for autonomous attacks. This shift represents a significant evolution in how threat actors monetize compromised cloud environments and stolen service credentials. ## Defensive Security Recommendations Defenders must prioritize identity and access management alongside supply chain security to prevent abuse. Organizations should use centralized secrets management platforms to rotate keys and implement least-access privileges. Automating secrets scanning within codebases is essential to identify and remove exposed API keys before they can be exploited by malicious actors. ## Sources covering this story - https://www.theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._