LLMJacking: stolen cloud and AI API access resold via LLM Mixers, with victim bills up to $1 million
Google Threat Intelligence Group (GTIG) and Mandiant report a rise in LLMJacking, where criminals use stolen cloud credentials and LLM API keys to run foundation models at the victim's expense. In 2026 Mandiant responded to several incidents in financial services, retail, technology and transportation across North America, South America and Asia Pacific. Charges exceeded $100,000 in a single day in some cases and reached up to $1 million before attackers lost access. GTIG sees a division of labor between initial-access groups and LLM Mixers, services that resell stolen model access to underground subscribers. GTIG expects criminals to favor LLMJacking over cryptojacking because resale monetizes quickly.
Entenda a falha
A vulnerabilidade
CVE-2026-40217 is a flaw in the LiteLLM gateway, which routes requests to AI models. According to Mandiant and GTIG, an attacker exploited it to turn ordinary access keys into administrator credentials, so it is a privilege escalation. The articles do not give the affected or fixed versions, the CVSS score, or whether authentication or a specific configuration is required beyond holding a valid key. The flaw is a side detail in a broader LLMJacking story, in which stolen cloud credentials and API keys are the main entry vector.
Como funciona
The articles do not describe the internal mechanism. They say only that the attacker already held ordinary access keys for a LiteLLM gateway, which sits between users and the AI models and routes their requests. By exploiting CVE-2026-40217, the attacker's ordinary keys ended up with administrator rights on that gateway. The step at which the gateway fails to separate normal from admin privileges is not detailed.
Por que é vulnerável
The articles do not state the root cause of CVE-2026-40217 or what the fix changes. The observed effect, ordinary keys becoming administrator credentials, points to a privilege-handling problem in the gateway, but the exact flaw is not described and should not be assumed.
Como foi descoberta
The flaw came to light through incident response: Mandiant, which handled several LLMJacking incidents in 2026, saw an attacker exploit CVE-2026-40217 in a LiteLLM gateway in one of them. The articles do not say who first found the flaw, when it was reported to the vendor, or when a fix was released. GTIG expects attackers to keep exploiting vulnerabilities in model-routing middleware.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 08:24.
Detalhes técnicos
- Attackers target backend model resources directly, either through publicly exposed LLM endpoints or valid LLM API keys, bypassing front-end chatbots.
- One group harvested API keys from public GitHub repositories and validated them with tiny requests that avoid triggering alerts.
- The most common entry vector was a stolen cloud credential: a service account key, a GitHub access token or an active session token.
- UNC6993 broke into a cloud instance through a misconfigured service account key and reached an AI API. It also ran a fake portal for joining a group of LLM users that tricked visitors into pasting data containing an active access token, bypassing passwords and MFA.
- After access, attackers searched code repositories and data warehouse tables for database credentials and admin passwords, and performed cloud storage operations tied to data theft.
- Some created backdoor accounts, one disguised as an internal billing optimization tool.
- In one case the attacker exploited CVE-2026-40217 in a LiteLLM gateway to turn ordinary access keys into administrator credentials.
- The Jet Night service sells an unlimited plan for about $60 a month, against $100-$250 for a legitimate equivalent, which GTIG believes is only profitable with stolen keys. An actor feeding it stolen API keys made over 500,000 model calls in under eight hours, leaving a victim with nearly $1 million in token costs. Jet Night announced several outages on Telegram, likely after victims revoked keys.
- In another case an attacker registered a lookalike domain imitating an internal victim host and funneled the victim's AI access into the resale operation newapi.pro.
- In several incidents the AI services were disabled at the time of compromise, and the attackers used stolen keys to enable them.
Remediação
- Monitor for changes to AI accounts and services, especially AI services being switched on unexpectedly (Mandiant advice).
Linha do tempo
-
LLMJacking: stolen cloud and AI API access resold via LLM Mixers, with victim bills up to $1 million
ler a análise desta fonte ocultar
Google Threat Intelligence Group (GTIG) and Mandiant report a rise in LLMJacking, where criminals use stolen cloud credentials and LLM API keys to run foundation models at the victim's expense. In 2026 Mandiant responded to several incidents in financial services, retail, technology and transportation across North America, South America and Asia Pacific. Charges exceeded $100,000 in a single day in some cases and reached up to $1 million before attackers lost access. GTIG sees a division of labor between initial-access groups and LLM Mixers, services that resell stolen model access to underground subscribers. GTIG expects criminals to favor LLMJacking over cryptojacking because resale monetizes quickly.
Technical Details
- Attackers target backend model resources directly, either through publicly exposed LLM endpoints or valid LLM API keys, bypassing front-end chatbots.
- One group harvested API keys from public GitHub repositories and validated them with tiny requests that avoid triggering alerts.
- The most common entry vector was a stolen cloud credential: a service account key, a GitHub access token or an active session token.
- UNC6993 broke into a cloud instance through a misconfigured service account key and reached an AI API. It also ran a fake portal for joining a group of LLM users that tricked visitors into pasting data containing an active access token, bypassing passwords and MFA.
- After access, attackers searched code repositories and data warehouse tables for database credentials and admin passwords, and performed cloud storage operations tied to data theft.
- Some created backdoor accounts, one disguised as an internal billing optimization tool.
- In one case the attacker exploited CVE-2026-40217 in a LiteLLM gateway to turn ordinary access keys into administrator credentials.
- The Jet Night service sells an unlimited plan for about $60 a month, against $100-$250 for a legitimate equivalent, which GTIG believes is only profitable with stolen keys. An actor feeding it stolen API keys made over 500,000 model calls in under eight hours, leaving a victim with nearly $1 million in token costs. Jet Night announced several outages on Telegram, likely after victims revoked keys.
- In another case an attacker registered a lookalike domain imitating an internal victim host and funneled the victim's AI access into the resale operation newapi.pro.
- In several incidents the AI services were disabled at the time of compromise, and the attackers used stolen keys to enable them.
Remediation
- Monitor for changes to AI accounts and services, especially AI services being switched on unexpectedly (Mandiant advice).