Mandiant warns of LLMJacking surge: stolen cloud and API credentials drive fraud of up to $1m per victim
Google's Mandiant reports that it has responded to multiple LLMJacking incidents this year in financial services, retail, technology and transportation. Financially motivated actors hijack access to enterprise large language models and resell it. Fraudulent charges exceeded $100,000 in a single day, and cumulative charges at some organizations reached $1m before access was revoked. The technique is not new, but the ecosystem is maturing, with a division of labor between initial access actors and downstream monetizers known as LLM Mixers. Google expects criminals to prioritize LLMJacking over cryptojacking.
Detalhes técnicos
- Actors bypass front-end chatbots and target backend model resources through LLM API keys or exposed or stolen cloud identity tokens. These include IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens.
- After the initial foothold, actors escalate privileges and run internal reconnaissance to find more targets and cloud credentials. They may also exploit vulnerabilities in LLM routing software to escalate privileges.
- Monetization works through token proxying, automated model streaming and GPU hardware provisioning.
- LLM Mixers are routing gateways that proxy, aggregate and resell LLM access to criminal customers.
- Mandiant has seen a diverse set of cybercrime clusters active in North America, South America and Asia Pacific.
- Mandiant expects more automated reconnaissance for exposed API tokens and more exploitation of model routing middleware as enterprises adopt higher-tier models and agentic workflows.
Linha do tempo
-
Mandiant warns of LLMJacking surge: stolen cloud and API credentials drive fraud of up to $1m per victim
ler a análise desta fonte ocultar
Google's Mandiant reports that it has responded to multiple LLMJacking incidents this year in financial services, retail, technology and transportation. Financially motivated actors hijack access to enterprise large language models and resell it. Fraudulent charges exceeded $100,000 in a single day, and cumulative charges at some organizations reached $1m before access was revoked. The technique is not new, but the ecosystem is maturing, with a division of labor between initial access actors and downstream monetizers known as LLM Mixers. Google expects criminals to prioritize LLMJacking over cryptojacking.
Technical Details
- Actors bypass front-end chatbots and target backend model resources through LLM API keys or exposed or stolen cloud identity tokens. These include IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens.
- After the initial foothold, actors escalate privileges and run internal reconnaissance to find more targets and cloud credentials. They may also exploit vulnerabilities in LLM routing software to escalate privileges.
- Monetization works through token proxying, automated model streaming and GPU hardware provisioning.
- LLM Mixers are routing gateways that proxy, aggregate and resell LLM access to criminal customers.
- Mandiant has seen a diverse set of cybercrime clusters active in North America, South America and Asia Pacific.
- Mandiant expects more automated reconnaissance for exposed API tokens and more exploitation of model routing middleware as enterprises adopt higher-tier models and agentic workflows.