# Google: LLMjacking starts with stolen cloud identities and has cost some companies $1 million

Source: https://startwithidentity.com/blog/2026-11-02-google-says-llmjacking-starts-with-stolen-cloud-identities-and-costs-up-to-1-million/
Last updated: 2026-11-02
License: content by Start with Identity. Cite the source URL.

---

Google Threat Intelligence Group and Mandiant said on November 2 that attackers hijacking enterprise access to large language models ran up fraudulent charges above $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked. The most common way in was a stolen cloud identity: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One group, UNC6993, broke in through a misconfigured service account key and hosted a fake portal that got users to paste a raw JSON payload holding an active access token, bypassing password and MFA. Another harvested LLM API keys from public GitHub repositories and confirmed they worked with single-token requests. Google says stolen access is resold through "LLM Mixers," gateways that pool stolen keys and meter usage for paying subscribers.

## Why it matters

[LLMjacking](https://startwithidentity.com/glossary/llmjacking/) is the invoice for the credential problem this month's stories keep showing: the [Gitee scan](https://startwithidentity.com/blog/2026-10-28-26400-working-cloud-and-ai-credentials-found-in-public-gitee-repositories/) found thousands of live AI keys, and [Northflank customers](https://startwithidentity.com/blog/2026-10-30-northflank-tells-customers-to-assume-environment-variables-were-decrypted/) saw stored AI keys used within hours. Google adds that in several incidents the LLM services were not even enabled before the attacker arrived; the attacker turned them on with the access it had stolen.

Google's guidance is identity first. Treat unauthorized enablement of an LLM service as a critical event, deny LLM permissions to identities that do not need them, scope API keys to specific models and environments, set quotas and spend caps, and enforce [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) on cloud consoles and developer platforms. The technique page is [static API key abuse](https://startwithidentity.com/techniques/static-api-key-abuse/), and our [non-human identity security guide](https://startwithidentity.com/guides/machine-identity/non-human-identity-security/) covers ownership and rotation.

Source: [Google Cloud Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models)