Google: LLMjacking starts with stolen cloud identities and has cost some companies $1 million

Google Threat Intelligence Group and Mandiant said on November 2 that attackers hijacking enterprise access to large language models ran up fraudulent charges above $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked. The most common way in was a stolen cloud identity: IAM credentials, service account keys, GitHub personal access tokens and active session tokens. One group, UNC6993, broke in through a misconfigured service account key and hosted a fake portal that got users to paste a raw JSON payload holding an active access token, bypassing password and MFA. Another harvested LLM API keys from public GitHub repositories and confirmed they worked with single-token requests. Google says stolen access is resold through "LLM Mixers," gateways that pool stolen keys and meter usage for paying subscribers.

Why it matters

LLMjacking is the invoice for the credential problem this month's stories keep showing: the Gitee scan found thousands of live AI keys, and Northflank customers saw stored AI keys used within hours. Google adds that in several incidents the LLM services were not even enabled before the attacker arrived; the attacker turned them on with the access it had stolen.

Google's guidance is identity first. Treat unauthorized enablement of an LLM service as a critical event, deny LLM permissions to identities that do not need them, scope API keys to specific models and environments, set quotas and spend caps, and enforce phishing-resistant MFA on cloud consoles and developer platforms. The technique page is static API key abuse, and our non-human identity security guide covers ownership and rotation.

Source: Google Cloud Threat Intelligence