Stolen AI access, resold at scale

The bill arrives before the breach is noticed. Google Threat Intelligence Group (GTIG) has documented a financially motivated criminal economy in which attackers hijack enterprise cloud and model access, then resell that access through underground subscription services while the victim's systems keep accepting requests on credentials they recognize as their own. In some cases, fake cloud charges exceeded $100,000 in a single day; cumulative costs reached $1 million before organizations revoked the compromised access.

The activity, which GTIG describes as LLMjacking, is not a theoretical risk. The group's analysis draws on multiple incidents in 2026 across cloud and LLM providers in North America, South America, and Asia Pacific. The mechanics are consistent enough to outline: steal credentials, validate them quietly, pool them into routing gateways, and sell access to paying customers who generate the consumption that lands on someone else's invoice.

Inside the LLM Mixer model

At the center of the monetization infrastructure are what GTIG calls LLM Mixers — criminal routing gateways that aggregate compromised API credentials and resell model access to underground subscribers. These services proxy requests across stolen accounts, distribute consumption, and hide the original source of access. The result is a subscription business built entirely on someone else's cloud bill.

GTIG identified multiple operations using open-source gateways and custom relay infrastructure to pool stolen credentials. One threat actor, tracked as UNC6993, used tools including new-api and gcli2api to aggregate stolen keys and distribute requests across accounts. Another operation used stolen third-party API keys to power Jet Night, a legitimate token-routing service that executed more than 500,000 LLM API calls in under eight hours, according to GTIG. That activity passed nearly $1 million in token costs to the victim organization.

Jet Night advertises unlimited access to frontier models for approximately $60 a month — a price far below the typical cost of comparable legitimate access. The service also experienced occasional outages that GTIG suspects were caused by victims discovering compromises and revoking keys.

Quiet validation before the spike

The attack begins well before the bill arrives. Initial access involves exposed or stolen cloud identity tokens, including IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. Attackers also harvest LLM API keys from public repositories and scan for exposed model endpoints.

Once inside, they validate stolen keys with minimal single-token requests, sometimes using max-tokens=1. Such micro-transactions confirm whether credentials work while staying below conventional consumption-based detection thresholds. After establishing access, attackers enumerate cloud services, repositories, and data stores for additional credentials. They may escalate privileges, create unauthorized service accounts, inject SSH keys, or establish persistence through compromised workloads.

GTIG also observed a follow-on threat actor exploiting a user ID rebinding vulnerability in the LiteLLM gateway to elevate ordinary virtual keys into administrative credentials. That detail matters because it shows the routing layer itself can become a path to broader access, not just a pass-through for stolen keys.

Why the resale model changes the math

Commodity cloud-credential theft is not new, but the resale layer alters the economics. A stolen key that is used directly burns until it is revoked. A stolen key that is resold through a mixer keeps working for paying customers, which gives the attacker an incentive to preserve access and avoid detection for as long as possible.

“Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important,” said Nick Tausek, lead security automation architect at Swimlane. “By the time someone asks why the cloud bill has exploded, the attacker may already have paying customers.”

— Nick Tausek, lead security automation architect at Swimlane

Tausek also pointed to the detection gap that micro-transactions exploit. “Testing a stolen key with a single-token request barely registers as consumption,” he said. “But pair that request with a newly created credential or an unexpected permission change, and there’s something worth investigating.” Analysts shouldn’t have to pull those connections together manually while the attacker gets a head start, he added.

Credential authority under pressure

Piyush Sharma, co-founder and CEO at Tuskira, framed the problem around how much trust is attached to each credential. “LLM Mixers turn stolen enterprise model access into a service for paying customers, while the victim’s systems continue accepting requests through credentials they recognize,” he said. “That puts a lot of weight on the authority attached to each credential. A key issued for one application shouldn’t become a reusable pass to other models and workloads.”

Sharma said organizations must restrict credentials to their intended models, workloads, and endpoints. “The gateway compromise described in these incidents deserves particular attention,” he said, warning that control of the routing layer could open access beyond the original compromised credential.

The numbers behind the invoices

• $100,000 — fake cloud charges a victim can exceed in a single day, per GTIG.
• $1 million — cumulative charges seen in some incidents before compromised access was revoked.
• 500,000+ — LLM API calls executed in under eight hours in one Jet Night operation.
• Nearly $1 million — token costs passed to the victim organization in that same operation.
• $60 a month — approximate price Jet Night advertises for unlimited access to frontier models.
• 2026 — the year the incidents analyzed by GTIG occurred.

Recommendations from GTIG

GTIG recommends tighter credential management, least-privilege permissions, granular API key scopes, monitoring for suspicious low-volume requests, and spending limits on model consumption. It also urges organizations to monitor unauthorized AI service enablement and gateway vulnerabilities.

The recommendations map directly to the attack chain observed in the incidents. Least-privilege permissions limit what a stolen key can reach. Granular scopes keep a key issued for one application from becoming a reusable pass to other models. Spending limits cap the damage while revocation is arranged. Monitoring for suspicious low-volume requests addresses the single-token validation step that attackers rely on to stay under consumption-based thresholds.

What this means for enterprises

The incidents GTIG describes suggest that AI consumption is now a line item attackers can monetize directly, not just a resource to abuse. An enterprise that treats its LLM API keys as ordinary application secrets may be underestimating what those keys are worth on the underground market — and how quickly the bill can move from unexpected to seven figures.

The resale layer also complicates incident response. When access is pooled and proxied across stolen accounts, revoking a single key may not stop a service that has other credentials in reserve; GTIG's suspicion that Jet Night outages followed victim revocations is consistent with a service that depends on a rotating pool of stolen access. This could mean that detection based solely on spend anomalies arrives too late, once paying customers are already generating traffic on the victim's account.

For security teams, the practical implication is to watch the routing layer as closely as the keys. A gateway compromise, as Sharma noted, can extend access beyond the original credential. Spending limits, scoped keys, and monitoring for low-volume validation requests are the controls GTIG points to, and they are most useful when applied before the invoice makes the breach visible.