Google Put Numbers on LLMjacking: $100,000 in a Day, Nearly $1 Million Before Anyone Noticed. The Stolen Key Is the Product, and the Storefronts Have Names.
On November 2, Google's Threat Intelligence Group and Mandiant published a report on LLMjacking, the theft of cloud and model access to run someone else's AI bill up. Their headline figures: fraudulent charges above $100,000 in a single day, and cumulative charges at some organizations reaching $1 million before access was revoked. We have been tracking this as a category since September, so this post is about what the report adds, and what you can check today.
What Google measured
The report describes a business, not a prank. Attackers get access to a victim's cloud identity, spend the victim's money on frontier models, and resell the capacity. Google's numbers, quoted as the report gives them:
Fraudulent charges tied to resource consumption exceeding $100,000 in a single day.
Cumulative charges at some organizations reaching $1 million before access was revoked.
One actor tracked as UNC6993 quickly ran up more than $100,000 in billing charges.
A reseller called Jet Night made more than 500,000 LLM API calls in under eight hours, and passed nearly $1 million in token costs to the victim organization.
Google does not give the number of incidents, the number of victims or a total loss across cases, so none of these are averages. They are the large cases Google chose to show.
How the access is stolen
Google says the dominant route is exposed or stolen cloud identity tokens: IAM credentials, service account keys, GitHub personal access tokens and live session tokens. The specific routes it describes:
A misconfigured service account key on a cloud instance, used to reach an LLM API.
A page posing as an application portal that asks the victim to paste a raw JSON payload containing an active access token. That skips the password and the MFA prompt.
A stolen GitHub token used to reach private repositories.
Corporate credentials used with cloud federation tokens to generate fresh access keys.
LLM API keys harvested from public GitHub repositories, checked with single-token test requests (max_tokens set to 1) so the volume stays under alert thresholds.
Exposed Ollama endpoints.
The pattern matches the two cases we wrote up earlier: the September post on an AI evaluation non-profit whose stolen key spent about $600,000 of inference over three weeks, and the October post on attackers who linked their own cloud projects to victims' billing and ran a model on the victims' money. Google's report is a larger sample of the same category.
The resale layer has names
Google calls the middlemen LLM Mixers: gateways that proxy, aggregate and resell unauthorized model access through storefronts. It names two of them in its indicator table, jet-night.com and newapi.pro. It says Jet Night relies on stolen keys to operate profitably, advertised an unlimited token plan at about $60 a month (against a typical $100 to $250 for the legitimate equivalent) and has posted outage notices on its Telegram channel. Google also names the open-source gateways one actor used, new-api and gcli2api, and says attackers pool and meter stolen credentials, then create and delete short-lived service accounts to get around rate limits.
Google names no malware family and no specific model; it says frontier models, and notes one persona that rebranded several of them. It also lists CVE-2026-40217, a LiteLLM flaw in the key regeneration path that was used to raise virtual keys to proxy admin. If you run LiteLLM, patch it.
Two further claims come from The Hacker News summarizing a Symantec report, not from Google, and we did not read the Symantec report: a grey-market relay that reinstalls genuine Codex and Claude Code command-line tools and rewrites their configuration files, aimed at users in mainland China and some subsidiaries. Treat that as reported, not verified.
What to do this week
Google's mitigation list is long. The parts that would have limited the damage in these cases:
Set budget alerts and granular API quotas on LLM services. A cap turns a $1 million bill into a smaller one.
Deny access to cloud LLM services by default and grant it only where needed.
Scan your repositories for keys with automated secret scanning, and scope each key by model, environment and usage limit.
Treat the unauthorized enabling of an LLM service as a critical event. Google lists the audit log events to watch on AWS, Azure and Google Cloud.
Look for validation sweeps: requests with max_tokens at 1 or temperature at zero, which are how stolen keys get tested.
Use phishing-resistant MFA, and teach people that a page asking them to paste a token is a theft.
What we hold
We ingested the two domains from Google's indicator table, credited to Google, under the source label manual-batch-llmjacking-gtig-2026-11. We did not ingest the Symantec-sourced relay domain, because we have only a secondhand summary of it. Google also points to a VirusTotal collection for registered users that we did not open.
Limits
We read Google's report, The Hacker News and The Register. We did not reproduce anything. The dollar figures are Google's and cover cases it selected, not the whole market. Two of the three headline numbers are per-case or cumulative at some organizations, and the Register's "$100K+ per day" headline is its paraphrase of Google.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments