Cybercriminals are stealing AI API keys and cloud credentials to run workloads on companies’ accounts, potentially generating bills of more than $100,000 in minutes. Google’s Threat Intelligence Group (GTIG) says the practice, known as LLMjacking, has grown over the past couple of years and is developing into a specialized cybercrime ecosystem.
Attackers typically begin by targeting exposed language-model endpoints or obtaining valid API keys. They may also use stolen cloud credentials, such as identity tokens, service-account keys, GitHub personal access tokens or active session tokens, to gain an initial foothold in an organization’s infrastructure. From there, they work to expand their privileges and maintain access.
GTIG describes LLMjacking as the unauthorized monetization and use of foundation models. Attackers can route requests through stolen accounts, stream model output automatically or provision GPU hardware. For victims, that means criminals use the company’s AI access while the company pays the bill.
The costs can accumulate quickly. Google reported that a group tracked as UNC6993 tried to create additional API keys and activate services in victims’ cloud projects, resulting in more than $100,000 in charges. In another case, an attacker enrolled victim accounts in pay-as-you-go plans, selected premium models and launched high-volume inference streams. The group repeatedly created and deleted short-lived service accounts to bypass rate limits while monitoring the resulting charges.
Some attackers also use compromised access to build proxy services and run agent-based workloads. In one operation, an actor set up publicly accessible reverse proxies and custom Node.js software to offer access to multiple frontier models under the name D1337-KAIROS. The actor also deployed a containerized backdoor that queried an LLM to interpret instructions and run commands locally.
GTIG says the ecosystem is becoming more specialized, with some groups gaining access to organizations and others handling the resale of that access. These downstream operators, described as “LLM Mixers,” use gateways to route, combine and sell unauthorized model access. Google observed two operational clusters coordinating to compromise and monetize enterprise AI infrastructure, using relay systems to pool stolen credentials, track usage and obscure the origin of requests.
Google expects criminals to increasingly pursue LLMjacking. It advises organizations to improve visibility into their AI platforms, monitor changes to accounts and services, treat unauthorized activations as critical security events, and restrict permissions to only those users and accounts that need them.
Sources: TechRadar.