The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

What it is

A Mandiant and Google Threat Intelligence Group (GTIG) report on LLMJacking incidents in 2026. Attackers use stolen cloud or LLM credentials to run and resell model inference on the victim's bill. The page's most usable content is the per-cloud audit-log operations to alert on, plus a few attacker behaviours that defeat common volume alerts.

How it works

The dominant entry vector was exposed or stolen cloud identity tokens (IAM credentials, service account keys, GitHub PATs, session tokens), not exposed LLM endpoints. Some specifics:

• A federation-token actor generated fresh access keys programmatically to get around MFA.
• UNC6993 ran a fake application portal that asked users to paste a raw JSON session token, which was posted to a backend to bypass password and MFA.
• One actor harvested LLM keys from public GitHub repositories and validated them with max_tokens=1 requests, which stayed under EDR and SIEM volume alerts.
• To get around rate limits, one actor ran a "burn and rotate" loop of creating and deleting short-lived service accounts.
• A LiteLLM gateway was attacked after Virtual Keys were obtained. A user ID rebind flaw in /key/regenerate (CVE-2026-40217) raised ordinary Virtual Keys to PROXY_ADMIN.
• Persistence used backdoor IAM or service accounts (one disguised as a billing optimization tool) and SSH keys injected into instance metadata.

In several incidents LLM services were not enabled at compromise time. The attacker used stolen keys to enable Bedrock or the Gemini API, then ran up large bills within minutes or hours.

What to do

Treat any unauthorized enablement of an LLM service as a critical event. Operations the page lists:

AWS (CloudTrail, bedrock.amazonaws.com)

• Use: Converse, InvokeModel, InvokeModelWithResponseStream.
• Error spikes: ThrottlingException, ValidationException, ResourceNotFoundException.
• Recon: ListFoundationModels, ListInferenceProfiles, GetFoundationModelAvailability.
• Model unlock: PutUseCaseForModelAccess, CreateFoundationModelAgreement.
• Logging tampering: GetModelInvocationLoggingConfiguration, PutModelInvocationLoggingConfiguration, DeleteModelInvocationLoggingConfiguration. Disabling by non-IaC principals is high severity.
• User-agents worth reviewing: claude-cli, aws-sdk-rust, aws-sdk-go-v2.

Azure (Microsoft.CognitiveServices)

• Management plane: accounts/deployments/write, plus accounts/read and accounts/deployments/read for recon.
• Inference is data plane only, so Diagnostic Logs must be on to see Completions or Chat Completions POST volume.
• Logging tampering: Microsoft.Insights/diagnosticSettings/read, write, delete.

GCP (aiplatform.googleapis.com)

• Alert on google.api.serviceusage.v1.ServiceUsage.EnableService.
• Inference: PredictionService.Predict, GenerateContent, StreamGenerateContent. These sit in Data Access logs, which are off by default and must be enabled.
• Recon: ModelService.ListModels, EndpointService.ListEndpoints, PublisherModelService.ListPublisherModels.
• Evasion checks: GetIamPolicy, ConfigServiceV2.ListSinks, GetSink.

Controls

• Alert on low-volume max_tokens=1 or zero-temperature pings at the gateway.
• Set per-model API quotas and spending caps.
• Scope API keys by model, environment and usage limit.
• Deny LLM service access to identities that do not need it.
• Patch LiteLLM and other routing gateways for CVE-2026-40217.
• Enforce phishing-resistant MFA and run secret scanning on repositories.

Google SecOps rules named as covering this activity include AWS Create New Access Key, GCP Service Account Key Creation, GCE Project SSH Keys, and Persistence: Compute Set Instance or Project Metadata Startup Scripts or URLs.

Caveats

The page gives no LiteLLM versions affected or fixed for CVE-2026-40217. IOCs are in a GTI Collection for registered users, and the table on the page is empty. GTIG's view that Jet Night depends on stolen keys is an inference from its pricing (about $60 a month for an unlimited plan) and its advertised outages.