LLMjacking Bills Reach $1 Million: Stolen Cloud Keys Switch On Enterprise AI Models, Then 'LLM Mixers' Like Jet Night Resell the Access

High · 2026-11-08 · By H.A

Google and Mandiant say criminals use leaked service-account keys, GitHub tokens and session tokens to hijack enterprise LLM access, running up more than $100,000 a day and reselling it through gateways such as Jet Night.

Overview

Google Threat Intelligence Group (GTIG) and Mandiant have published a report on LLMjacking: criminals hijacking an organisation's paid access to large language models and reselling it. On 3 November 2026 they described several incident-response cases from 2026. Victims were in financial services, retail, technology and transportation across North America, South America and Asia Pacific.

LLMjacking does not build up slowly the way cryptojacking does. In the cases described, fraudulent model charges topped $100,000 in a single day, and some organisations reached about $1 million in total before the stolen access was revoked.

The Campaign

GTIG describes a criminal economy where the work is split between two kinds of actor:

• Initial-access actors steal cloud identities or model API keys and check that they work.
• "LLM Mixer" operators run routing gateways that pool stolen credentials, meter usage, hide where requests come from and sell model access to underground subscribers.

In one case, a follow-on cluster got pre-validated "Virtual Keys" handed over by the initial-access actor. One storefront GTIG names, Jet Night, advertised an "unlimited" plan with frontier-model access for about $60 a month. Comparable legitimate plans usually cost $100–$250, and GTIG believes that price only works with stolen keys. It also links outages that Jet Night announced on Telegram to victims revoking keys. One actor tied to this ecosystem made more than 500,000 API calls in under eight hours, leaving one victim with nearly $1 million in token costs.

A cluster tracked as UNC6993 got in through a misconfigured service-account key on a cloud instance. It then created extra API keys and enabled more services in the victim's project, building up more than $100,000 in charges.

Timeline

• 2026: Mandiant handles several LLMjacking incidents across three regions.
• 3 November 2026: GTIG and Mandiant publish their findings, with detection guidance and two mixer domains.

Tradecraft

Initial access

• Exposed or stolen cloud identity material was the main way in: IAM credentials, service-account keys, GitHub personal access tokens and live session tokens.
• A fake application portal got users to paste raw JSON containing active access tokens. That skipped both the password and MFA.
• Cloud federation tokens were used to mint fresh access keys without MFA.
• Model API keys were harvested from public GitHub repositories.
• Exposed Ollama endpoints were probed so the attackers could register their own models.

Validation and evasion. One actor tested stolen keys with max_tokens=1 requests. These are tiny calls that stay below volume-based alerting. Another created and deleted short-lived service accounts ("burn and rotate") to get around rate limits.

Escalation and persistence. Actors searched repositories, storage and data-warehouse metadata for hard-coded secrets. They used token-creation rights to impersonate high-privilege service accounts and took secrets from cloud secret managers. They also planted backdoor IAM accounts made to look like billing utilities and injected SSH keys into VM metadata.

Gateway exploitation. GTIG highlights CVE-2026-40217 in the LiteLLM model gateway. A user-ID rebind flaw in the /key/regenerate endpoint let attackers turn an ordinary Virtual Key into a PROXY_ADMIN master credential.

Monetisation. Methods included signing victim accounts up to pay-as-you-go agreements for premium models, setting up GPU instances across regions with quota increases requested by API, running self-hosted agent stacks, and pushing access into resale gateways built on the open-source new-api and gcli2api projects.

Indicators of Compromise

GTIG published two LLM Mixer domains (full indicators are in a VirusTotal collection for registered users):

jet-night[.]com
newapi[.]pro

Detection

Treat any unexpected enablement of a model service as a critical event. In several incidents, Bedrock or the Gemini API had never been switched on before the attackers enabled it with stolen keys.

• AWS CloudTrail (bedrock.amazonaws.com): watch for spikes in InvokeModel, InvokeModelWithResponseStream and Converse; reconnaissance such as ListFoundationModels; model unlocking through PutUseCaseForModelAccess or CreateFoundationModelAgreement; and any change to model invocation logging by a principal that is not your IaC pipeline.
• Azure: look for unexpected Microsoft.CognitiveServices/accounts/deployments/write operations and changes to diagnostic settings.
• GCP: watch for ServiceUsage.EnableService on aiplatform.googleapis.com and GenerateContent / StreamGenerateContent volume. Data Access logs are off by default and must be turned on.
• Alert on bursts of near-empty prompts (max_tokens=1, zero temperature), new access keys or service accounts, and SSH keys added to project metadata.

A quick check on AWS for recent Bedrock enablement and logging changes:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=bedrock.amazonaws.com \
  --max-results 50 --query 'Events[].{t:EventTime,n:EventName,u:Username}' --output table

Recommended Actions

1. Set per-model quotas and spending caps plus billing alerts on every account that can reach a model API, including accounts where AI is "not used".
2. Use organisation policies to deny model services by default, and enable them only where needed.
3. Move secrets into a central manager with automatic rotation. Scan code repositories for API keys and service-account JSON.
4. Scope API keys by model, environment and usage limit. Enforce phishing-resistant MFA on consoles and developer platforms.
5. Patch LiteLLM and other model gateways as part of normal vulnerability management, with CVE-2026-40217 first.
6. Turn on data-plane logging for model services so abuse can be seen and investigated.

Analyst Assessment

LLMjacking makes money faster than cryptojacking: there is no mining delay, and the victim pays premium per-token rates directly. GTIG expects it to increasingly replace cryptojacking. The split between key thieves and resellers looks like the mature access-broker markets seen in ransomware, and it will be hard to dismantle. For most organisations the main exposure is not their AI product but any leaked cloud credential that can switch a model service on. Billing limits and service-enablement alerts are the quickest and cheapest controls.