LLMJacking Bills Hit $1m at Some Firms

Some organizations have been billed as much as $1m for cloud resources they never intended to buy, according to Google's Mandiant threat intelligence unit. The culprit is a technique called LLMJacking, in which criminals hijack access to large language models and resell that access to paying customers on the illicit market — while the bill lands on the victim's account.

Mandiant said it has responded to multiple incidents this year across financial services, retail, technology, and transportation, as reported by Infosecurity Magazine. The underlying technique is not new, but the ecosystem around it appears to be maturing, with specialized roles and routing infrastructure now sitting between the people who break in and the people who cash out.

How the billing gets hijacked

LLMJacking does not begin with the AI model itself. According to Mandiant, attackers bypass front-end chatbots and go after the backend model resources, typically entering through LLM API keys or exposed or stolen cloud identity tokens. The credentials named in the report include IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens.

Those are the kinds of credentials that often sit in configuration files, CI/CD pipelines, and developer tooling, which is what makes them valuable to an intruder who wants to reach cloud infrastructure quietly rather than through a public-facing application.

Once inside with an initial foothold, the attackers escalate privileges and carry out internal reconnaissance to identify further targets and more cloud credentials. Mandiant also noted they may target vulnerabilities in LLM routing software to escalate privileges.

The cost spike is what sets it apart

The financial damage separates LLMJacking from older forms of resource theft. Mandiant drew the contrast directly with cryptojacking, the long-running practice of mining cryptocurrency on someone else's compute.

"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," it warned.

— Google's Mandiant

The unit went on to describe what those spikes look like in practice: "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1m before access was revoked."

That phrasing matters. The bills accumulated until the access was revoked, meaning the money was spent before anyone noticed and shut the door. For organizations with slower detection or billing alerts that lag behind actual consumption, the window between compromise and discovery is where the loss is realized.

From stolen credentials to resale

Per the report, the end goal of an LLMJacking operation is the monetization and resource-hijacking of foundation models. Mandiant said actors achieve this through token proxying, automated model streaming, and GPU hardware provisioning.

In plain terms, the stolen access becomes a service. The criminal does not necessarily need to use the model themselves; they need to be able to pass queries to it, at volume, without the victim's organization understanding who is behind those requests.

Mandiant said it has already seen "a diverse set" of financially motivated cybercrime clusters carrying out LLMJacking across North America, South America, and Asia Pacific.

The rise of the 'LLM Mixers'

One of the more notable observations in the report is that the criminal economy around this technique has begun to split into roles. Mandiant said it has noticed a division of labor between threat actors who focus on gaining initial access and those who monetize the downstream infrastructure — a group it calls LLM Mixers.

These mixers are described as routing gateways that proxy, aggregate, and resell access to LLMs for criminal customers. The person who steals the credentials and the person who runs the resale shop need not be the same, and the separation makes the operation easier to scale.

That structure is what turns a single compromised key into a repeatable revenue line, with the victim's quota being consumed on one side and the billing quietly mounting on the other.

Where the numbers land

The figures Mandiant published are specific, and they sketch the shape of the loss:

• $100,000 in fraudulent resource charges observed in a single day during individual incidents.
• $1m in cumulative charges at some organizations before access was revoked.
• Incidents responded to across financial services, retail, technology, and transportation.

Mandiant said the activity has been observed across North America, South America, and Asia Pacific, indicating the problem is not confined to a single market or regulatory environment.

Why Google expects a shift in priority

Google expects cybercriminals to prioritize LLMJacking over cryptojacking going forward, citing how lucrative the work has become. That is a forecast rather than an observed trend, but it follows from the economics described in the report: the charges arrive fast, the resale market exists, and the infrastructure needed to run it has already been assembled by the mixers.

Mandiant's conclusion looked ahead to enterprises moving higher-tier models and agentic workflows into production environments. In that scenario, it expects cybercriminals to refine automated reconnaissance aimed at exposed API tokens and to exploit vulnerabilities in model routing middleware.

"This operational specialization will sustain a growing illicit resale marketplace, allowing threat actors to rapidly siphon enterprise quotas while passing the billing costs to victims before compromises are detected," it concluded.

— Google's Mandiant

The emphasis on agents and routing middleware is worth noting for anyone deploying them: the more components sit between a user and a model, the more places credentials and permissions have to be tracked.

The credential trail is the attack surface

Nothing in Mandiant's account points to a flaw in a specific model. The entry points it lists are familiar ones — API keys, IAM credentials, service account keys, GitHub tokens, session tokens — and the escalation steps it describes, privilege escalation and internal reconnaissance, are standard intrusion tradecraft applied to a new target.

What is new is the payoff. Where an attacker who lands a cloud credential might once have used it to spin up compute for mining, they can now use it to serve model access to customers, and the victim's own consumption bill becomes the invoice for the criminal business.

Mandiant's report follows earlier coverage of LLMJacking, including research on LLMjacking and open-source tool abuse surging in 2024 cloud attacks. The current warning extends that picture with observed incident costs and a description of how the criminal supply chain has organized itself.

What this means for defenders

For organizations running AI workloads in the cloud, the practical implication is that credential hygiene and billing visibility now sit on the same threat model. If the financial damage shows up as a spike in consumption charges, then monitoring for abnormal usage and setting alerting thresholds could be as relevant as watching for intrusion attempts — and revocation speed appears to be the variable that caps the loss.

Mandiant's account suggests the identity layer deserves scrutiny too: exposed tokens and keys, particularly in developer and CI environments, are the primary pathway described. Whether the resale market continues to specialize as Google predicts, the economics it describes give attackers a strong reason to keep looking for those credentials.