Skip to content

Back to the catalog

Google: LLMjacking attacks rack up $1 million in cloud AI charges
bleepingcomputer.comarticle

Google: LLMjacking attacks rack up $1 million in cloud AI charges

LLMjacking is the abuse of stolen API keys and exposed LLM endpoints to run fraudulent model calls. Google's GTIG and Mandiant report charges above $100,000 per day and up to $1,000,000 cumulatively at some victims. Attackers resell access through "LLM mixers" such as Jet Night and newapi[.]pro; cluster UNC6993 and LiteLLM CVE-2026-40217 exploitation are noted, with IAM, MFA, spending-limit and logging advice.

TL;DR Reports Google research showing stolen LLM API keys resold via mixer services caused up to $1M in cloud AI charges per victim.
Open original ↗
Document

What it is

Google's Threat Intelligence Group (GTIG) and Mandiant describe LLMjacking as two cooperating operations. One group scans for publicly exposed LLM endpoints. The other steals valid API keys from unprotected machines. Access is then sold to "LLM mixers", which proxy subscribers' prompts through the hijacked accounts. The provider bills the victim for the tokens as legitimate use.

How it works

Initial access comes from exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens and LLM API keys. Once inside, attackers search the environment for credentials, logs, databases and secret managers. They try to create backdoor accounts or inject SSH keys for persistence.

Resale can push request volume above 1,000 requests per second. One Jet Night operator made more than 500,000 API calls in under eight hours using stolen third-party keys. Google says that passed nearly $1 million in token costs to the victim. Jet Night sells "unlimited access plans" for $60/month, so the price subscribers pay bears no relation to the cost imposed on victims.

Cluster UNC6993 appears to use gateway tools to aggregate stolen keys and spread requests across them. Google says it likely sells access on underground forums.

Some attackers also exploit CVE-2026-40217 in LiteLLM. The flaw gives arbitrary code execution on the server through the custom-code guardrail testing endpoint. Others use the victim's cloud to host their own infrastructure. One actor enabled agents, deployed public reverse proxies and used custom Node.js proxy bundles. These exposed endpoints compatible with several frontier LLMs, rebranded as "D1337-KAIROS".

Preconditions / Affected

  • Any organization with LLM API keys, cloud credentials or tokens stored where unprotected machines can leak them.
  • LLM endpoints reachable from the public internet.
  • LiteLLM deployments exposed to CVE-2026-40217. The page gives no affected versions or fixed release.

What to do

  • Keep keys and secrets in a centralized secrets platform with rotation. Grant extended privileges only where a role needs them.
  • Google's wording: "Deny all permissions that are not explicitly required, including access to Cloud LLM services."
  • Enforce phishing-resistant MFA.
  • Use monitoring that can find unauthorized LLM and AI services (shadow AI).
  • Set API usage and spending limits. These are the control that caps a runaway bill.
  • Enable cloud audit and inference logs. Alert on unauthorized service activation, suspicious credential checks, unusual usage and attempts to disable logging.
  • Check the environment for unexpected reverse proxies, agent workloads, new accounts and injected SSH keys, since attackers use the victim's infrastructure and persist there.

Caveats

The page gives no indicators of compromise beyond the names Jet Night, jet-night.com, newapi[.]pro, UNC6993 and D1337-KAIROS. It has no LiteLLM patch guidance and no detection queries. The $100,000 per day and $1,000,000 figures come from the incidents Google analyzed, so they are not a general estimate.

Organisations named here

  • Google Threat Intelligence Group
  • Mandiant

CVEs named here

  • CVE-2026-40217

Technologies named here

  • LiteLLM
  • LLM
  • GitHub
  • Node.js
  • SSH
  • Adaptive Security
  • Cloud AI platforms billing per token
  • Cloud LLM services
  • Publicly exposed LLM endpoints

Techniques named here

  • Credential discovery in compromised environments
  • Exploitation of LiteLLM CVE-2026-40217
  • Persistence through backdoor accounts and SSH key injection
  • Resale of access via LLM mixers
  • Scanning for publicly exposed LLM endpoints
  • Stolen API key and credential abuse

Concepts named here

  • Shadow AI
  • Least privilege
  • LLMjacking
  • LLM mixers

Threat actors named here

  • D1337-KAIROS (persona under which a threat actor rebranded frontier LLM-compatible endpoints, using enabled agents, publicly accessible reverse proxies and custom Node.js proxy bundles)
  • Jet Night (jet-night.com, LLM mixer token routing service selling "unlimited access plans" for $60/month; one actor made more than 500,000 LLM API calls in less than eight hours with stolen third-party API keys, passing nearly $1 million in token costs to the victim organization)
  • LLM mixers (services that resell unauthorized LLM access through proxy infrastructure)
  • newapi[.]pro (LLM mixer relay service)
  • UNC6993 (threat cluster that appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums)

Also named here

  • UNC6993
  • Jet Night
  • newapi.pro
  • D1337-KAIROS

Related in Threat Intel