Google Warns of LLMjacking Attacks Costing Enterprises $1 Million
Attackers are hijacking enterprise LLM API keys to exploit expensive cloud computing resources.
1The Rise of LLMjacking
LLMjacking represents a sophisticated evolution of resource hijacking specifically targeting Large Language Models. Unlike cryptojacking, which consumes resources gradually, this method triggers immediate, massive spikes in cloud billing. Attackers exploit exposed API keys or misconfigured environments to force organizations to pay for unauthorized, high-intensity AI model consumption and GPU usage.
2Financial Impact Analysis
The financial damage from these attacks is significant and rapid. Google observed individual incidents where fraudulent charges exceeded $100,000 within a single day. In severe cases, cumulative billing reached $1 million before the compromised access was revoked. This creates an urgent need for enterprises to monitor cloud consumption patterns more effectively.
3Common Access Vectors
Attackers gain initial footholds through various vulnerabilities, including exposed GitHub Personal Access Tokens and misconfigured Service Account keys. Threat actors like UNC6993 also utilize session hijacking pages that trick users into pasting raw JSON payloads. These methods effectively bypass standard password protections and multi-factor authentication controls, granting attackers deep network access.
4Operational Tactics Used
Once inside, attackers escalate privileges to establish persistence and conduct internal reconnaissance. They frequently employ a burn and rotate strategy, creating and deleting short-lived service accounts to bypass rate limits. This allows them to scale operations within victim cloud projects while remaining undetected by traditional security monitoring tools for extended periods.
5Emergence of LLM Mixers
The ecosystem has matured into a specialized division of labor with the rise of LLM Mixers. These entities function as illicit routing gateways that aggregate and resell stolen access to other criminal actors. Services like Jet Night offer unlimited token plans, allowing bad actors to siphon enterprise quotas while passing costs to victims.
6Grey Market Relay Services
Beyond direct hijacking, grey market services install legitimate CLI tools like OpenAI Codex or Anthropic Claude Code, then reconfigure them. By disabling sandboxes and routing requests through third-party infrastructure, these services exploit regional access gaps. This activity has been observed impacting sectors like semiconductors and pharmaceuticals in South Korea, Taiwan, and Malaysia.
7Technical Configuration Hijacking
The reconfiguration process involves modifying local files such as settings.json or config.toml to override security defaults. Scripts often check Windows locale settings to ensure the system is in a target region before finalizing the setup. This process disables telemetry and error reporting, effectively blinding the organization to the unauthorized use of their resources.
8Future Security Outlook
Google anticipates that cybercriminals will increasingly prioritize LLMjacking over traditional cryptojacking due to higher profit margins. As enterprises integrate agentic workflows into production, the attack surface for exposed API tokens grows. Organizations must prioritize strengthening identity visibility and assessing AI threat readiness to defend against these sophisticated, automated model routing exploits.