# Google Finds LLMjacking Attackers Costing $100K Daily

> Attackers hijack cloud access to run AI services, costing businesses $100,000 daily.
- Title: Google Finds LLMjacking Attackers Costing $100K Daily
- Summary: Attackers hijack cloud access to run AI services, costing businesses $100,000 daily. Google reports LLMjacking attackers generate fraudulent cloud charges…
- Keywords: google, llmjacking, cloud charges, fraudulent, api keys, mandiant, google threat intelligence group, llm, cryptojacking, llm mixers, jet night, technology
- Source: SiliconANGLE — https://siliconangle.com/2026/11/02/google-finds-llmjacking-attackers-running-up-100k-a-day-in-fraudulent-cloud-charges
- Author: Duncan Riley
- Published: 2026-11-02T15:00:41+00:00
- Read time: 1 min
- Topics: google, llmjacking, cloud charges, fraudulent, api keys, mandiant, google threat intelligence group, llm, cryptojacking, llm mixers, jet night, technology
## Google Report on LLMjacking
Google's Mandiant and Threat Intelligence Group found attackers using stolen credentials to run AI services costing over $100,000 daily.
## Cost Impact on Businesses
Some organizations faced $1 million in charges before access was revoked by attackers.
## LLMjacking vs Cryptojacking
LLMjacking charges spike quickly, unlike cryptojacking which drains resources gradually.
## Victim Industries
Financial services, retail, technology, and transportation companies in North America, South America, and Asia-Pacific were targeted.
## Attack Methods
Attackers used stolen service account keys, GitHub tokens, and exposed LLM endpoints to gain access.
## UNC6993 Attack
UNC6993 used a fake portal to steal access tokens from victims via JSON payloads.
## API Key Scraping
Attackers scraped GitHub repositories for API keys and tested them with small requests to bypass security alerts.
## CVE-2026-40217 Vulnerability
A flaw in LiteLLM allowed attackers to turn virtual keys into master administrator credentials.
## Burn and Rotate Strategy
Attackers created and deleted service accounts to avoid rate limits and generate high costs.
## LLM Mixers
Attackers sell stolen credentials through 'LLM Mixers' to hide usage and origin of requests.
## Key takeaway

Google reports LLMjacking attackers generate fraudulent cloud charges exceeding $100,000 per day through stolen credentials and API keys.