Stolen cloud credentials are giving criminals a way to run AI models while victims pay the bill. Google Threat Intelligence Group and Mandiant investigated incidents in which attackers accumulated up to $1 million in charges before their access was cut off.
The danger is not limited to expensive model usage. Once inside a company’s environment, attackers can reactivate dormant AI services, harvest additional credentials, establish backdoors and redirect model capacity into an illicit resale operation.
A business model built on stolen access
LLMJacking separates the intrusion from the monetization. One group breaks into corporate environments, while another operates an LLM Mixer: a service that gathers stolen model access and sells it to underground subscribers.
That division of labor makes each stolen credential potentially repeatable. A reseller can serve multiple customers without maintaining a direct relationship with the victim, while the compromised company remains responsible for the usage.
One threat actor made more than 500,000 model calls in less than eight hours, leaving its victim with nearly $1 million in token costs. In other cases, attackers routed requests through a lookalike domain and a resale platform called newapi.pro, using depleted customer quotas to support paying users.
Why the financial damage accelerates so quickly
Cryptojacking typically consumes computing resources gradually. LLMJacking is faster because stolen credentials authorize paid model requests directly. That lets attackers generate a concentrated spike in charges within hours.
The resale economics make the incentive clearer. Jet Night, an identified LLM Mixer, reportedly offered unlimited access for about $60 a month, compared with legitimate prices of $100 to $250 for comparable subscriptions. GTIG believes that gap means the service would need stolen keys to remain profitable.
The winners are the operators controlling resale infrastructure and the subscribers receiving cheap model access. The losers are the companies whose credentials and quotas fund the service, as well as legitimate providers competing with a product whose apparent costs are shifted elsewhere.
For defenders, an abnormal AI invoice therefore represents more than a budgeting problem. It may be evidence that attackers have found a renewable source of billable capacity.
The intrusion starts with ordinary credentials
The initial access methods were not exotic. One group collected API keys from public GitHub repositories and sent tiny requests to test whether they worked without alerting the owner. More frequently, investigators encountered stolen cloud credentials such as service account keys, GitHub access tokens and active session tokens.
These credentials can also bypass familiar controls. Researchers documented a fake portal that encouraged visitors to paste data containing an active token, allowing attackers to circumvent passwords and multifactor authentication. Another group, tracked as UNC6993, entered through a misconfigured service account key and reached an AI API from a compromised cloud instance.
Inside the environment, the attackers widened their access. In one intrusion, they searched data warehouse tables for database credentials, administrator passwords and sensitive columns before conducting cloud storage operations associated with data theft. Others created backdoor accounts, including one disguised as an internal billing optimization tool.
The routing layer is another target. In one case, attackers exploited CVE-2026-40217 in a LiteLLM gateway, converting ordinary access keys into administrator credentials. A compromised gateway could therefore provide use over the model connections it manages.
Why it matters: revocation is only the first move
Revoking the exposed key addresses one access path, not necessarily the entire intrusion. Attackers may already have copied credentials, created new accounts or elevated their permissions. A reseller domain may also continue serving traffic until the underlying keys and quotas are closed off.
Several incidents described by Mandiant began with AI services that had been switched off. Attackers used stolen credentials to turn those services back on, making unusual service reactivation a particularly useful warning sign.
The practical trade-off is between immediate disruption and a complete investigation. Waiting preserves evidence but permits further usage, while broad shutdowns may interrupt legitimate operations. That makes the response decision checklist more useful than treating key rotation as the end of the incident.
Incident decision checklist
Use this sequence when usage, credentials or service activity suggest LLMJacking:
- Contain the billing path:** Revoke exposed API keys and cloud credentials, including service account keys, GitHub tokens and active session tokens.
- Check service state:** Identify AI services that were disabled and then reactivated during the suspected intrusion window.
- Trace unusual demand:** Review request volume, unfamiliar model traffic and activity associated with lookalike domains or third-party resale platforms.
- Audit identities:** Look for newly created accounts, backdoor accounts and permission changes, including credentials disguised as internal tools.
- Search for secondary access:** Examine repositories, databases and cloud storage for credentials, administrator passwords and sensitive data that may have been harvested.
- Review model gateways:** Investigate routing middleware for unauthorized administrative changes or ordinary keys that acquired elevated privileges.
- Preserve evidence:** Retain logs and records needed to determine how access was obtained, what it reached and which systems may remain compromised.
The checklist should run alongside cloud and identity controls. Revocation limits immediate use, but repository searches, gateway review and account audits address the persistence mechanisms investigators found.
What to watch next
GTIG expects criminals to favor LLMJacking over cryptojacking because resale allows access to be monetized quickly while the victim absorbs the expense. As enterprises adopt higher-tier models and agentic workflows, researchers expect more automated reconnaissance against exposed API tokens and vulnerabilities in model-routing middleware.
The warning signs are likely to appear before or alongside the financial damage: high-volume API traffic, sudden activation of dormant services, new administrative accounts, permission changes and requests routed through unfamiliar domains. Monitoring only known AI workloads may miss the broader credential abuse.
The key lesson is that AI usage, identity activity and cloud billing need to be reviewed together. A sharp cost increase can expose an active intrusion, while quieter credential changes can reveal how attackers intend to keep access after the first key is revoked.
Key takeaways
- Treat exposed AI API keys and cloud credentials as security incidents, not configuration mistakes.
- Monitor AI request volume, dormant service activation, account creation and permission changes together.
- Look for secondary access in repositories, databases, gateways and cloud storage.
- Revoke compromised credentials while investigating backdoors, elevated privileges and reseller infrastructure.
Frequently asked questions
What is LLMJacking?
It is the unauthorized use and resale of access to AI models or their cloud resources. Attackers use stolen credentials to generate model calls, often through intermediary services, while the victim bears the charges.
How much can a LLMJacking incident cost?
Mandiant investigations found bills reaching up to $1 million. One actor made more than 500,000 calls in less than eight hours, leaving the victim with nearly $1 million in token costs.
How did attackers commonly obtain initial access?
Researchers found exposed API keys in public GitHub repositories and stolen cloud credentials such as service account keys, GitHub tokens and active session tokens. Attackers also used fake portals that tricked users into providing active tokens.
Why is revoking one API key not enough?
Attackers may have copied credentials, created backdoor accounts, stolen additional secrets or gained administrator privileges through model-routing middleware. The exposed key should be revoked while the wider environment is investigated.