LLMjacking surge: stolen cloud and LLM API credentials drive fraud of $100K+ per day and up to $1M per victim, resold via LLM Mixers

Linha do tempo

1. olhardigital.com.br ↗ · pub. 03/11/2026 15:17 · coletado 03/11 16:01

   LLMjacking Campaigns Abuse Stolen Cloud and API Credentials to Hijack LLM Services, Google Warns

   ler a análise desta fonte ocultar

   Google Threat Intelligence Group (GTIG) has reported a growing wave of LLMjacking attacks, in which threat actors steal cloud and API credentials to hijack corporate access to large language model (LLM) services and transfer usage costs to victim organizations. Attackers typically obtain access via stolen IAM credentials, service account keys, GitHub personal access tokens, and active session tokens, or by finding publicly exposed LLM endpoints and API keys. One actor tracked as UNC6993 generated new credentials and enabled additional cloud services in victim projects, racking up over US$100,000 in charges. Other groups enrolled compromised accounts in pay-per-use plans, ran high-volume inference on premium models, and used a "burn and rotate" technique—creating and deleting temporary service accounts—to evade usage limits while monitoring billing dashboards to gauge financial impact.

   Technical Details

   Beyond direct abuse, some actors resell stolen LLM access through an emerging criminal role called LLM Mixers, who aggregate, proxy, and resell unauthorized model access to underground market customers using open-source API gateways and custom relay frameworks. GTIG also observed a criminal deploying publicly accessible reverse proxies and custom Node.js frameworks to offer multi-model compatible services, as well as a container-based backdoor that queried an external LLM to interpret instructions and execute commands locally.

   Remediation

   GTIG recommends organizations increase visibility into their AI platforms, monitor for unauthorized changes to accounts and associated services, treat any unauthorized resource activation as a critical security incident, and enforce the principle of least privilege to limit permissions for users and service accounts.

2. bleepingcomputer.com ↗ · pub. 03/11/2026 15:51 · coletado 03/11 16:00

   LLMjacking Campaigns Rack Up $1 Million in Fraudulent Cloud AI Charges

   This article adds detail on a threat actor persona dubbed D1337-KAIROS that enabled agentic workloads, deployed public reverse proxies, and used custom Node.js proxy bundles to expose multi-LLM-compatible endpoints within compromised victim cloud infrastructure, and provides Google's expanded remediation guidance covering IAM prioritization, supply chain security, phishing-resistant MFA, API spending limits, and audit/inference log monitoring.

   ler a análise desta fonte ocultar

   This article adds detail on a threat actor persona dubbed D1337-KAIROS that enabled agentic workloads, deployed public reverse proxies, and used custom Node.js proxy bundles to expose multi-LLM-compatible endpoints within compromised victim cloud infrastructure, and provides Google's expanded remediation guidance covering IAM prioritization, supply chain security, phishing-resistant MFA, API spending limits, and audit/inference log monitoring.

   Google's Threat Intelligence Group (GTIG) and Mandiant detail how LLMjacking attacks abuse stolen cloud and LLM API keys to generate fraudulent AI usage charges, with some victim organizations billed over $100,000 in a single day and cumulative losses reaching $1 million. Two coordinated threat clusters operate: one scans for exposed LLM endpoints, the other harvests valid API keys from unprotected machines, then resells access through LLM mixer services such as Jet Night and newapi[.]pro. Attackers also exploited CVE-2026-40217 in LiteLLM to gain arbitrary code execution via a custom-code guardrail testing endpoint. Google recommends strict IAM controls, phishing-resistant MFA, API spending limits, and enhanced logging to detect and prevent these attacks.

   Technical Details

   • Threat cluster UNC6993 uses gateway tools to aggregate stolen keys and distribute requests, likely selling access via underground forums.
   • One actor executed over 500,000 LLM API calls in under eight hours using stolen third-party keys routed through Jet Night (jet-night.com), costing the victim nearly $1 million.
   • Attackers search compromised environments for credentials, logs, databases, and secret managers, and attempt to create backdoor accounts or inject SSH keys for persistence.
   • A threat actor using the persona D1337-KAIROS enabled agentic workloads, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs.

   Remediation

   • Prioritize Identity and Access Management (IAM) and secure the software supply chain.
   • Use centralized secrets platforms for key rotation and management; enforce least-privilege access, denying all permissions not explicitly required, including Cloud LLM service access.
   • Enforce phishing-resistant MFA and ensure monitoring tools provide full visibility to detect shadow AI usage.
   • Set API usage and spending limits, and enable/monitor cloud audit and inference logs for unauthorized activation, suspicious credential checks, and logging-disable attempts.
3. darkreading.com ↗ · pub. 03/11/2026 12:35 · coletado 03/11 14:00 só resumo do feed

   LLMJacking Campaigns Expand, Reselling Stolen Cloud LLM Access Costs Victims Up to $1M

   ler a análise desta fonte ocultar

   Cybercriminals have industrialized LLMjacking, the practice of stealing cloud credentials to gain unauthorized access to hosted large language models (LLMs) and reselling that access to other threat actors. According to the report, attackers harvest exposed or leaked cloud API keys and credentials for services such as AWS, Azure, and Google Cloud to access LLM endpoints like Amazon Bedrock and other generative AI services, then resell proxied access through underground channels. Some victim organizations reportedly faced bills as high as $1 million in resource consumption before their cloud providers detected the abuse and revoked access. The activity represents a growing monetization vector distinct from traditional data theft, turning compromised cloud accounts into a recurring revenue stream for criminal resellers.

   Technical Details

   Attackers typically obtain valid cloud credentials through leaked secrets, misconfigurations, or credential-stuffing, then use them to invoke LLM APIs at scale, generating massive compute costs billed to the victim's account. Access is often resold to other actors who use it to run their own AI workloads, bypassing subscription costs and usage restrictions, while obscuring the resold access behind the original victim's infrastructure.

   Remediation

   Organizations are advised to monitor cloud billing and API usage for anomalies, rotate and restrict cloud credentials, apply least-privilege IAM policies, enable logging/alerting on LLM API invocations, and quickly revoke exposed keys found in code repositories or configuration leaks.

4. thehackernews.com ↗ · pub. 03/11/2026 12:41 · coletado 03/11 14:00

   LLMjacking Campaigns Rack Up to $1M in Cloud Charges as New Relay Service Hijacks AI CLI Tools

   This article adds that UNC6993 scaled its operation by creating additional API keys to generate over $100,000 in fraudulent charges, and notes a 'burn and rotate' tactic using short-lived service accounts to evade rate limits. It names the Jet Night LLM Mixer domain (jet-night[.]com) explicitly and introduces a separate but related finding from Symantec/Carbon Black: a grey-market relay service that reconfigures legitimate OpenAI Codex and Anthropic Claude Code CLI installations (via a script hosted on vibe.aiok[.]me, modifying config.toml/settings.json) to route AI traffic through third-party servers, active since early 2026 and primarily affecting organizations in Mainland China, South Korea, Taiwan, and Malaysia across industrial automation, electronics, semiconductor, pharmaceutical, shipping, tire manufacturing, petrochemical, and data center sectors.

   ler a análise desta fonte ocultar

   This article adds that UNC6993 scaled its operation by creating additional API keys to generate over $100,000 in fraudulent charges, and notes a 'burn and rotate' tactic using short-lived service accounts to evade rate limits. It names the Jet Night LLM Mixer domain (jet-night[.]com) explicitly and introduces a separate but related finding from Symantec/Carbon Black: a grey-market relay service that reconfigures legitimate OpenAI Codex and Anthropic Claude Code CLI installations (via a script hosted on vibe.aiok[.]me, modifying config.toml/settings.json) to route AI traffic through third-party servers, active since early 2026 and primarily affecting organizations in Mainland China, South Korea, Taiwan, and Malaysia across industrial automation, electronics, semiconductor, pharmaceutical, shipping, tire manufacturing, petrochemical, and data center sectors.

   Google Threat Intelligence Group (GTIG) and Mandiant detail how LLMjacking operators abuse stolen cloud and LLM credentials to run foundation models at victims' expense, with single-day fraud exceeding $100,000 and cumulative charges reaching $1 million before access is revoked. The threat actor UNC6993 used a misconfigured Service Account key to reach an LLM API, then created additional API keys to scale abuse, racking up over $100,000 in charges, while some actors use a 'burn and rotate' strategy with short-lived service accounts to dodge rate limits. The report also names the LLM Mixer Jet Night (jet-night[.]com), which resells unlimited token access for about $60/month, and references a separate Symantec/Carbon Black report on a grey-market relay service that reconfigures genuine OpenAI Codex and Anthropic Claude Code CLIs to route traffic through third-party infrastructure, primarily impacting organizations in Mainland China, South Korea, Taiwan, and Malaysia across industrial, electronics, semiconductor, pharmaceutical, and data center sectors.

   Technical Details

   • Initial access vectors include stolen IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens; one attacker chained a stolen PAT with exploitation of a web application vulnerability in a containerized cloud environment.
   • Post-compromise behaviors include enumerating cloud services and repositories for secrets, cross-region reconnaissance, cloning codebases for hard-coded credentials, scanning access logs, running database queries for credentials, exploiting token-creation privileges to generate high-privilege temporary credentials, and injecting SSH keys for persistence.
   • The relay service documented by Symantec installs the legitimate Codex/Claude Code CLIs via npm, then uses a fileless PowerShell/bash script fetched from the lookalike domain vibe.aiok[.]me to rewrite ~/.codex/config.toml or ~/.claude/settings.json, disabling sandboxing, enabling write-sandbox network access, swapping in relay-issued API tokens, and disabling telemetry/error reporting. The script checks Windows locale to confirm it is targeting the intended region before completing setup.
   • No evidence was found that the relay service harvests prompts or tampers with model responses, but it exposes organizations to unmonitored, unauthorized AI infrastructure.
5. helpnetsecurity.com ↗ · pub. 03/11/2026 06:39 · coletado 03/11 08:01

   LLMJacking: stolen cloud and AI API access resold via LLM Mixers, with victim bills up to $1 million

   ler a análise desta fonte ocultar

   Google Threat Intelligence Group (GTIG) and Mandiant report a rise in LLMJacking, where criminals use stolen cloud credentials and LLM API keys to run foundation models at the victim's expense. In 2026 Mandiant responded to several incidents in financial services, retail, technology and transportation across North America, South America and Asia Pacific. Charges exceeded $100,000 in a single day in some cases and reached up to $1 million before attackers lost access. GTIG sees a division of labor between initial-access groups and LLM Mixers, services that resell stolen model access to underground subscribers. GTIG expects criminals to favor LLMJacking over cryptojacking because resale monetizes quickly.

   Technical Details

   • Attackers target backend model resources directly, either through publicly exposed LLM endpoints or valid LLM API keys, bypassing front-end chatbots.
   • One group harvested API keys from public GitHub repositories and validated them with tiny requests that avoid triggering alerts.
   • The most common entry vector was a stolen cloud credential: a service account key, a GitHub access token or an active session token.
   • UNC6993 broke into a cloud instance through a misconfigured service account key and reached an AI API. It also ran a fake portal for joining a group of LLM users that tricked visitors into pasting data containing an active access token, bypassing passwords and MFA.
   • After access, attackers searched code repositories and data warehouse tables for database credentials and admin passwords, and performed cloud storage operations tied to data theft.
   • Some created backdoor accounts, one disguised as an internal billing optimization tool.
   • In one case the attacker exploited CVE-2026-40217 in a LiteLLM gateway to turn ordinary access keys into administrator credentials.
   • The Jet Night service sells an unlimited plan for about $60 a month, against $100-$250 for a legitimate equivalent, which GTIG believes is only profitable with stolen keys. An actor feeding it stolen API keys made over 500,000 model calls in under eight hours, leaving a victim with nearly $1 million in token costs. Jet Night announced several outages on Telegram, likely after victims revoked keys.
   • In another case an attacker registered a lookalike domain imitating an internal victim host and funneled the victim's AI access into the resale operation newapi.pro.
   • In several incidents the AI services were disabled at the time of compromise, and the attackers used stolen keys to enable them.

   Remediation

   • Monitor for changes to AI accounts and services, especially AI services being switched on unexpectedly (Mandiant advice).
6. infosecurity-magazine.com ↗ · pub. 03/11/2026 07:45 · coletado 03/11 08:01

   Mandiant warns of LLMJacking surge: stolen cloud and API credentials drive fraud of up to $1m per victim

   ler a análise desta fonte ocultar

   Google's Mandiant reports that it has responded to multiple LLMJacking incidents this year in financial services, retail, technology and transportation. Financially motivated actors hijack access to enterprise large language models and resell it. Fraudulent charges exceeded $100,000 in a single day, and cumulative charges at some organizations reached $1m before access was revoked. The technique is not new, but the ecosystem is maturing, with a division of labor between initial access actors and downstream monetizers known as LLM Mixers. Google expects criminals to prioritize LLMJacking over cryptojacking.

   Technical Details

   • Actors bypass front-end chatbots and target backend model resources through LLM API keys or exposed or stolen cloud identity tokens. These include IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens.
   • After the initial foothold, actors escalate privileges and run internal reconnaissance to find more targets and cloud credentials. They may also exploit vulnerabilities in LLM routing software to escalate privileges.
   • Monetization works through token proxying, automated model streaming and GPU hardware provisioning.
   • LLM Mixers are routing gateways that proxy, aggregate and resell LLM access to criminal customers.
   • Mandiant has seen a diverse set of cybercrime clusters active in North America, South America and Asia Pacific.
   • Mandiant expects more automated reconnaissance for exposed API tokens and more exploitation of model routing middleware as enterprises adopt higher-tier models and agentic workflows.
7. theregister.com ↗ · pub. 02/11/2026 13:00 · coletado 02/11 13:00 primeiro registro

   LLMjacking campaigns by UNC6993 and others drain $100K+ per day in fraudulent LLM token charges from victim cloud accounts

   ler a análise desta fonte ocultar

   Google Mandiant and Google Threat Intelligence Group (GTIG) report that criminals are hijacking corporate LLM and cloud AI access ("LLMJacking"), generating fraudulent charges that can exceed $100,000 per day. Cumulative charges at some victims reached $1 million before access was revoked. The activity has grown steadily over two years, and Google expects actors to prioritize it over cryptojacking. The cluster tracked as UNC6993 is cited in a mid-2026 incident that cost a victim $100,000. GTIG also describes a division of labor between initial-access brokers and downstream monetization operators called "LLM Mixers".

   Technical Details

   • UNC6993 compromised a cloud instance via a misconfigured Service Account key, then gained access to a model API. It generated additional API keys and enabled services within the victim's cloud projects.
   • The actor also ran a fake application-portal page that tricked users into pasting a raw JSON payload containing an active access token. The token was posted to a backend API, bypassing password and MFA controls.
   • A separate actor subscribed victim accounts to Pay-As-You-Go agreements, selected premium foundation models and ran high-volume inference. It used a "burn and rotate" strategy, creating and deleting short-lived service accounts to bypass rate limits while monitoring the billing interface.
   • Another intruder made more than 500,000 LLM API calls in under eight hours with stolen third-party API keys to power the token routing service Jet Night. Jet Night sells an unlimited plan for about $60 per month, well below market rates (typically $100-$250), which GTIG believes is only profitable with stolen keys. Its public Telegram channel admitted outages, likely caused by victims revoking keys.
   • CrowdStrike's August report documented a token thief sending about 200,000 API requests in two minutes.

   Remediation

   • Prioritize identity and access management and supply chain security.
   • Use a centralized secrets management platform and rotate keys and secrets.
   • Apply least-privilege permissions to users and service accounts.
   • Automate secrets scanning in codebases to find and remove API keys committed to source code.