LLMJacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.
Cybercriminals have created a thriving business model out of stealing cloud access to commercial large language models (LLMs) and reselling it to paying customers, with the resource cost for victims reaching high as $1 million before access to their LLM was revoked.
The practice, called LLMjacking, has been around almost as long as LLMs themselves. However, now it’s become an illicit enterprise on the underground market, providing a lucrative source of revenue for cybercriminals while victims are left to absorb the high cost of model usage, according to a report published Monday from Google Threat Intelligence Group (GTIG) and Mandiant.
LLMjacking can create a massive spike in computing resources in a matter of hours, differentiating it from its more well-known cousin, cryptojacking, which gradually consumes resources. This has made it an attractive revenue stream for “a diverse set of financially motivated threat clusters operating out of multiple regions globally,” Google researchers shared in the report.
“Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked,” they wrote.
The report details how attackers gain initial access to LLMs and achieve persistence on targeted networks, and describes the service model around LLMjacking that has become a lucrative endeavor for cybercriminals.
LLMjacking: Silent But Deadly
To gain initial access to an organization’s LLM, attackers typically identify publicly exposed LLM endpoints or obtain valid LLM application programming interface (API) keys, according to Google.
“The dominant initial access vector has been exposed or stolen cloud identity tokens — including identity and access management (IAM) credentials, service account keys, GitHub personal access tokens (PATs), and active session tokens — which threat actors leverage to establish an initial foothold into target organizations’ infrastructure,” the researchers wrote.
Some attackers also deliberately keep their initial activity quiet to gain access to an organization’s LLM, according to Google. The researchers observed the use of minimal API requests, sometimes containing just one output token, to validate stolen credentials without generating significant consumption.
This sneaky way to gain and then sell access to the LLM could mean organizations are giving up valuable resources without even knowing, while the attacker is cashing in, notes Nick Tausek, lead security automation architect at agentic AI firm Swimlane.
“By the time someone asks why the cloud bill has exploded, the attacker may already have paying customers,” he says. “Selling stolen model access gives criminals a reason to keep that access working for as long as possible, which makes the quiet activity before the spending spike especially important.”
This notably represents a detection challenge for organizations that need to identify early indicators of compromised identities, unauthorized permissions, and suspicious access to AI services rather than just look for unusual consumption, he says.
Tricks of the Trade
The report outlines several examples of how attackers comprised and LLMjacked organizations, demonstrating that there is not just one route to take for successfully and illicitly gaining access to an LLM.
In the middle of the year, for example, a threat cluster tracked as UNC6993 compromised a cloud instance through a misconfigured service account key and used it to grant further access to an LLM API. Attackers also hosted a session hijacking page mimicking an application portal to join a group of LLM users.
“This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multifactor authentication (MFA) controls,” the researchers explained.
In another instance, a threat actor gained initial entry by combining a stolen personal access token (PAT) to access private code repositories and a suspected Web application vulnerability in a package running within a containerized cloud environment.
Similarly, a different threat actor used compromised cloud federation tokens to programmatically generate new access keys that allowed the attacker to bypass MFA protections, according to Google.
LLMjacking Actors Mixing it Up
Once access to an LLM has been gained, it then needs to be sold for attackers to make money. The key to this part of the LLMjacking business model is what is called an LLM Mixer, which are underground services that turn stolen access to commercial AI models into a subscription business, according to Google. These services aggregate compromised credentials, route customer requests through victim environments, and offer access to premium models at prices significantly below legitimate market rates.
As the researchers describe it, LLM mixers act as illicit middlemen, allowing cybercriminals to resell access to compromised enterprise LLM accounts without their customers needing their own legitimate API credentials or cloud infrastructure.
“In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space,” the researchers wrote.
Indeed, LLM Mixers are an important part of the emerging LLMjacking ecosystem because they provide the monetization layer that makes stealing enterprise AI access financially attractive.
Defense Strategies for LLMjacking
Since LLMjacking relies on victims being unaware for as long as possible, the key to not getting dinged with a huge resource-consumption bill is to catch on as quickly as possible to the intrusion.
To do this, defenders should prioritize IAM and supply chain security, two of the most common pathways for gaining access to and abusing cloud services, according to Google.
Other best practices for preventing LLMjacking in a cloud environment include good credential hygiene by using a centralized secrets-management platform; least privilege by ensuring users and service accounts only possess the permissions necessary for their specific role and required tasks; and code monitoring by automating secret scanning within codebases such as GitHub and GitLab.
Routine configuration audits, rate limiting, network allow listing, budget alerts, and MFA also are good defense strategies, according to Google.
