Google Threat Intelligence Group reports that threat actors are hijacking enterprise access to large language models across AWS, Azure, and GCP, a tactic dubbed LLMJacking. Unlike cryptojacking, these intrusions produce massive billing spikes — over $100,000 in a single day — by exploiting stolen cloud identities and API keys to provision models and resell access through illicit proxy services called LLM Mixers.
Initial Access via Stolen Identities and Exposed Endpoints
Threat actors gain footholds primarily through exposed or stolen cloud identity tokens — IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. In mid-2026, UNC6993 compromised a cloud instance via a misconfigured service account key and used it to grant further LLM API access, while also hosting a session-hijacking page that tricked users into pasting raw JSON payloads containing active access tokens to bypass MFA.
Other clusters combined stolen PATs with suspected web application vulnerabilities in containerized environments, or used compromised IAM credentials with cloud federation tokens to programmatically generate fresh access keys that circumvented MFA. Attackers also harvested corporate LLM API keys from public GitHub repositories and validated them stealthily using minimal single-token requests (max_tokens=1) to evade EDR and SIEM volume alerts.
Beyond credential theft, actors target publicly exposed LLM endpoints such as Ollama instances. Automated scripts probe endpoints like /api/create to register their own models on unprotected services, expanding the attack surface and driving up hosting costs for victims who left these interfaces open to the internet.
Lateral Movement, Privilege Escalation, and Persistence
Once inside, actors enumerate cloud services, code repositories, and data stores for additional credentials. One intrusion saw cross-region reconnaissance to map services and identity policies; another involved cloning sensitive codebases to hunt hardcoded secrets and scanning access logs for secondary cloud environment credentials. Actors also queried cloud data warehouse metadata tables for database credentials and admin passwords while exfiltrating data from object storage.
Privilege escalation leverages cloud identity permissions and VM configurations. Threat actors exploited token-creation privileges on compromised service accounts to generate temporary credentials for high-privilege roles, extracting infrastructure credentials, database passwords, and third-party API keys from secret managers. Persistence techniques included creating unauthorized IAM and service accounts, injecting SSH keys into compute instances, and attaching administrative policies to service roles.
A notable escalation path targeted LLM routing software directly. After acquiring pre-validated virtual keys from an initial-access actor, a follow-on cluster exploited a user ID rebind vulnerability in LiteLLM's /key/regenerate endpoint (CVE-2026-40217) to elevate standard virtual keys into PROXY_ADMIN master credentials, establishing deep persistent control over the compromised gateway.
Monetization Through LLM Mixers and Proxy Infrastructure
The end goal is monetizing hijacked model access. UNC6993 generated additional API keys and enabled managed generative platforms, racking up over $100,000 in daily charges. Another actor subscribed victim accounts to pay-as-you-go agreements for premium models and launched high-volume inference streams using a "burn and rotate" strategy — continuously creating and deleting short-lived service accounts while monitoring billing interfaces to track financial impact.
Actors host their own proxy endpoints and agentic workloads. One deployed reverse proxies, custom Node.js bundles, and a containerized backdoor using the Manus agent framework with SearXNG metasearch and agent-infra/sandbox execution environments. They provisioned GPU instances across regions, requested quota increases via cloud APIs, and hosted LiteLLM gateways on external servers to manage and route API traffic.
Stolen credentials are pooled and resold through LLM Mixers — illicit routing gateways that aggregate, meter, and obscure request origins. UNC6993 used open-source tools new-api and gcli2api to aggregate keys and balance loads, likely selling access via underground storefronts. The service jet-night.com processed over 500,000 API calls in under eight hours, passing nearly $1 million in token costs to victims while offering unlimited frontier model access for $60/month — far below market rates — with outages correlating to key revocations.
What to do next
Defenders should enable Data Access audit logs for AI platforms, alert on service enablement events, monitor for low-volume credential validation sweeps (max_tokens=1), enforce least-privilege API key scopes, and patch model gateways like LiteLLM against CVE-2026-40217. Budget alerts and granular quotas on LLM services can limit financial exposure before compromises are detected.
Source: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources (GCP).
