LLMJacking: Threat Actors Rack Up $1M in Fraudulent Cloud Charges

• •LLMJacking incidents led to over $1 million in fraudulent charges for some organizations.
• •Attackers primarily exploited exposed cloud identity tokens and misconfigured service accounts.
• •The threat landscape includes multiple financially motivated clusters operating globally.

Mandiant and Google Threat Intelligence Group reported multiple incidents of 'LLMJacking' in 2026, where attackers hijacked enterprise access to large language models (LLMs), resulting in fraudulent cloud charges exceeding $100,000 in a single day. Victims, including organizations in North America, South America, and Asia-Pacific across various sectors, faced cumulative charges reaching $1 million before access was revoked. Unlike cryptojacking, LLMJacking can generate rapid spikes in costs. Attackers primarily exploited exposed or stolen cloud identity tokens, such as service account keys and GitHub personal access tokens, to gain initial access. A notable group, UNC6993, compromised a cloud instance through a misconfigured service account key and created a fake portal to harvest access tokens. The report highlights a growing underground market for LLM credentials and emphasizes the need for organizations to secure their cloud infrastructure against these threats.