Cloud Credentials Theft Fuels LLMJacking Attacks, Exploiting Corporate AI Models
Enterprise AI
Google's Mandiant reported multiple LLMJacking attacks in 2026 where attackers used stolen cloud credentials and API keys to exploit corporate AI models. Threat actors resold access for profit, leaving victims with steep bills. Researchers advise tightening access controls, setting cost alerts, and monitoring API anomalies.
Google's Mandiant and the Google Threat Intelligence Group (GTIG) reported on LLMJacking attacks in 2026, where threat actors stole cloud credentials and API keys to exploit enterprise LLMs. Similar to cloud crypto-mining hijacking, attackers may monetize model access through illicit proxy services like LLM Mixers, causing victims to absorb over 100,000 dollars per day in cloud fees, with an incident incurring nearly a million dollars in under 8 hours. Attackers also activated previously unused LLM services in breached environments. Researchers recommend stricter IAM controls, anomaly monitoring, and usage quota alerts.
Key takeaways
- Mandiant reported attackers use stolen cloud credentials and API keys to exploit enterprise AI models, causing some victims daily costs exceeding 100,000 dollars.
- GTIG found an incident where a stolen key routed through Jet Night made over 500,000 API calls in under 8 hours, causing nearly a million dollars in charges.
- In some incidents, attackers compromised cloud environments and unauthorizedly activated unused services like Amazon Bedrock or Gemini API to consume resources.
- Researchers advise strengthening service account permissions, monitoring API spikes and costs, and establishing usage quotas and alerts for early detection.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.