The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

Summary

Mandiant and Google Threat Intelligence Group describe LLMJacking, in which threat actors hijack enterprise access to large language models and generate fraudulent cloud charges, sometimes exceeding $100,000 in a single day and reaching $1 million cumulatively before access was revoked. Attackers reach backend model resources directly, either by finding publicly exposed LLM endpoints such as /api/create or by using stolen cloud identity tokens, with exposed or stolen cloud identity tokens described as the dominant initial access vector. The report also tracks specialized "LLM Mixers" that resell unauthorized LLM access to underground subscribers.

Related items

• InfoAnthropic reports $17 billion in Q3 revenue, purchase commitments of $895.4 billion in revised S-1Same vendor · CNBC Technology
• InfoStop counting tokens, start counting what shipsSame vendor · MIT Technology Review
• MediumHundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake FeaturesSame vendor · Wired (Security)
• InfoThe agentic web is hereSame vendor · MIT Technology Review
• MediumNew VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial ValueSame vendor · The Hacker News