Google’s Mandiant and Threat Intelligence Group reported on November 2, 2026 that LLMJacking attacks are generating fraudulent model charges of more than $100,000 in a single day. Some organizations reached $1 million in cumulative charges before access was revoked. Victims included financial services, retail, technology, and transportation firms in North America, South America, and Asia Pacific.
Key Takeaways
- Mandiant saw LLMJacking bills top $100,000 in a single day.
- Some organizations reached $1 million before access was revoked.
- Mixers resell stolen access; GitHub-key scraping is often a separate role.
- Stolen keys turned on Bedrock or Gemini where LLM services were off.
How LLMJacking Attacks Gain a Foothold
Unlike cryptojacking, which drains compute gradually, LLMJacking spikes in hours. Actors skip chatbots and hit backend resources directly. In Mandiant’s 2026 investigations, the main foothold was exposed or stolen identity: IAM credentials, service account keys, GitHub personal access tokens, and session tokens.
Documented paths included:
- Corporate LLM API keys scraped from public GitHub repos and tested with max_tokens=1 requests that stayed under EDR and SIEM volume alerts.
- Exposed Ollama servers, where a script called /api/create to register models.
- UNC6993, in mid-2026, using a misconfigured service account key to reach an LLM API, plus a fake portal that collected raw JSON access tokens and bypassed passwords and MFA.
- A stolen personal access token used to reach private repositories, combined with a suspected web-application flaw in a package running in a containerized cloud environment.
- Compromised IAM users whose federation tokens generated fresh keys and circumvented MFA.
Escalation Beyond the First Key
After entry, actors enumerated services, cloned repositories for hardcoded secrets, scanned logs for other cloud credentials, and queried data-warehouse metadata for passwords. They also created unauthorized IAM accounts, attached admin policies, injected SSH keys into virtual machines, and disguised a backdoor service account as a billing-optimization utility.
Privilege jumps were not limited to cloud IAM. A follow-on cluster took pre-validated virtual keys and exploited CVE-2026-40217, a user-ID rebind bug in LiteLLM’s key regeneration endpoint, elevating them to PROXY_ADMIN. Teams watching how an unrevoked key opened a LiteLLM supply-chain attack now have a second failure mode: a rebind that promotes a virtual key to admin.
How Mixers Turn Access Into Bills
UNC6993 generated more API keys, enabled services in victim projects, and passed $100,000 in charges. Another actor subscribed accounts to pay-as-you-go terms on premium models and used a burn and rotate pattern, creating and deleting short-lived service accounts to bypass rate limits. A separate intrusion planted a containerized backdoor built on the Manus agent framework: an upstream model reasoned through instructions, and the host ran the commands.
GTIG sees a split between initial-access groups and LLM Mixers, gateways that proxy and resell stolen model use while hiding request origin. Scraping GitHub keys and reselling access through mixers are related, but they are often separate roles rather than one combined behavior. Two clusters coordinated that handoff in one investigation.
SiliconANGLE’s account of the report says UNC6993 used tools such as new-api and gcli2api, likely to pool keys, and that GTIG believes the group sells access through underground storefronts. Jet Night, one mixer, was powered by more than 500,000 API calls in under eight hours on stolen third-party keys; one victim absorbed nearly $1 million in token costs. It sells an unlimited plan claiming frontier access for about $60 a month, versus typical consumer plans of $100 to $250. GTIG thinks prices that low only work on stolen keys.
| Measure | Reported figure |
|---|---|
| Single-day fraudulent charges | More than $100,000 |
| Cumulative charges before revocation | $1 million at some organizations |
| Jet Night unlimited plan | About $60 a month |
| Typical consumer frontier plans | $100 to $250 a month |
| One Jet Night victim token costs | Nearly $1 million |
| Calls in one Jet Night case | More than 500,000 in under eight hours |
In several cases the victim had never enabled LLM services. Stolen keys were used to turn on Amazon Bedrock and Google’s Gemini API, and a bill could balloon within minutes. The research says unauthorized enablement should be treated as a critical security event. GTIG expects attackers to favor LLMJacking over cryptojacking because mixers pay quickly at high margins, and expects more automated targeting of exposed tokens and routing middleware as higher-tier models and agentic workflows go into production.
Controls That Cut the Bill
Analysis for platform teams: the expensive failures are familiar — public repo keys, identities that can enable Bedrock or Gemini, and gateways that a rebind can promote to admin.
SiliconANGLE’s summary of the report’s defensive guidance includes spending caps, keys scoped to specific models and environments, and log monitoring for the single-token pings used to validate stolen keys. Unauthorized enablement of model APIs should be treated as a critical security event, not as a routine alert on every enablement.
LavX News adds reader advice, not a list of report recommendations: strengthen identity and access management, secure supply chains, rotate keys automatically through centralized secrets management, apply least-access privileges, and scan codebases for exposed API keys.
“Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks,” said John Hultquist, chief analyst at Google Threat Intelligence Group, as reported by SiliconANGLE.
