From SiliconANGLE · Duncan Riley · · 1m 20s
Google Finds LLMjacking Attackers Costing $100K Daily
Attackers hijack cloud access to run AI services, costing businesses $100,000 daily.
In brief
Attackers hijack cloud access to run AI services, costing businesses $100,000 daily. Google reports LLMjacking attackers generate fraudulent cloud charges exceeding $100,000 per day through stolen credentials and API keys. Originally reported by SiliconANGLE.
Google Report on LLMjacking
Google's Mandiant and Threat Intelligence Group found attackers using stolen credentials to run AI services costing over $100,000 daily.
Cost Impact on Businesses
Some organizations faced $1 million in charges before access was revoked by attackers.
LLMjacking vs Cryptojacking
LLMjacking charges spike quickly, unlike cryptojacking which drains resources gradually.
Victim Industries
Financial services, retail, technology, and transportation companies in North America, South America, and Asia-Pacific were targeted.
Attack Methods
Attackers used stolen service account keys, GitHub tokens, and exposed LLM endpoints to gain access.
UNC6993 Attack
UNC6993 used a fake portal to steal access tokens from victims via JSON payloads.
API Key Scraping
Attackers scraped GitHub repositories for API keys and tested them with small requests to bypass security alerts.
CVE-2026-40217 Vulnerability
A flaw in LiteLLM allowed attackers to turn virtual keys into master administrator credentials.
Burn and Rotate Strategy
Attackers created and deleted service accounts to avoid rate limits and generate high costs.
LLM Mixers
Attackers sell stolen credentials through 'LLM Mixers' to hide usage and origin of requests.
The headline
Google reports LLMjacking attackers generate fraudulent cloud charges exceeding $100,000 per day through stolen credentials and API keys.
