LLMjacking turns stolen credentials into costly cloud bills

Cybercriminals are stealing AI API keys and cloud credentials to run expensive workloads at victims’ expense, according to Google’s Threat Intelligence Group (GTIG). Known as LLMjacking, the practice targets exposed model endpoints and compromised accounts, allowing attackers to consume services, provision GPU resources and operate unauthorized proxy infrastructure.

Attackers use stolen identity tokens to gain access, escalate privileges and enable additional services. Google said UNC6993 attempted to generate more API keys within compromised cloud projects, quickly accumulating over $100,000 in billing charges. Another attacker selected premium models under pay-as-you-go agreements and launched high-volume inference streams, repeatedly creating and deleting short-lived service accounts to bypass rate limits while monitoring billing activity.

The criminal ecosystem is developing a division of labor between groups that establish access and operators that monetize it. Google calls the latter “LLM Mixers”: routing gateways that aggregate and resell stolen access to underground subscribers. Open source API gateways and custom relay infrastructure let attackers pool credentials, meter usage and conceal where requests originate.

Google expects attackers to increasingly prioritize LLMjacking over other forms of resource theft. It urges organizations to improve visibility across LLM platforms, detect changes to accounts and services, treat unauthorized service enablement as a critical security event, and restrict permissions through least-privilege controls.