INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Cybercriminals Hijack Enterprise Access to Large Language Models

| 2026-11-03 18:55 HIGH HIGH AI-ENABLED ATTACK · AUTONOMOUS CYBERATTACK (GENERAL) INDUSTRY & POLICY
JSON
Executive Summary
AI-generated
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. Cybercriminals have created a thriving business model out of stealing cloud access to commercial large language models (LLMs) and reselling it to paying customers, with the resource cost for victims reaching high as $1 million before access to their LLM was revoked. Threat actors are hijacking enterprise access to Large Language Models through a tactic called LLMJacking, impacting organizations across North America, South America, and Asia Pacific in financial services, retail, technology, and transportation sectors.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc.
Technical Observables 4 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 4 IoCs Create Free Account
domains 3 files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
AnchorAnchor CVE-2026-40217CVE-2026-40217
Target & Sectors
APAC APAC LATAM LATAM NORTH_AMERICA NORTH_AMERICA financefinance retailretail manufacturingmanufacturing transportationtransportation technologytechnology
Incident Timeline
‎2026/10/27
According to a report published by Broadcom-owned Symantec and Carbon Black last week, there exists a grey market relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, only to…
‎2026/11/03
Threat actors are hijacking enterprise access to Large Language Models (LLMs) through a tactic called LLMJacking, impacting organizations across North America, South America, and Asia Pacific in financial services, retail, technology, and transportation sectors.
financial $1 million
Related: External Teams Chats Anchor 15-Minute Malware Delivery "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked," they wrote.
"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.
Unlike cryptojacking's gradual consumption, LLMJacking generates massive spikes in fraudulent cloud charges, with incidents exceeding $100,000 USD daily and reaching $1 million USD cumulatively.
organisation LLMjacking
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
The report details how attackers gain initial access to LLMs and achieve persistence on targeted networks, and describes the service model around LLMjacking that has become a lucrative endeavor for cybercriminals.
"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News.
financial $100,000
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Related: External Teams Chats Anchor 15-Minute Malware Delivery "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked," they wrote.
"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.
organisation LLM Mixers
Some threat actors attempt to bypass rate limits by adopting a "burn and rotate" strategy that involves continuously creating and deleting short-lived service accounts The maturation of the LLMjacking ecosystem has also paved the way for the emergence of a new category of actors called LLM Mixers, highlighting a division of labor between attackers who establish initial access and those who man…
They escalate privileges, conduct reconnaissance, and monetize compromised resources through LLM Mixers—illicit routing gateways that proxy and resell unauthorized LLM access.
organisation UNC6993
In the middle of the year, for example, a threat cluster tracked as UNC6993 compromised a cloud instance through a misconfigured service account key and used it to grant further access to an LLM API.
This includes a threat actor called UNC6993, which is said to have breached a cloud instance through a misconfigured Service Account key and used it to obtain access to an LLM API.
organisation Mandiant
"Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours," Google Threat Intelligence Group and Mandiant said in a report shared with The Hacker News.
organisation Marvell
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security In another instance, a threat actor gained initial entry by combining a stolen personal access token (PAT) to access private code repositories and a suspected Web application vulnerability in a package running within a containerized cloud environment.
organisation Standardize Data Center
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security In another instance, a threat actor gained initial entry by combining a stolen personal access token (PAT) to access private code repositories and a suspected Web application vulnerability in a package running within a containerized cloud environment.
organisation GitHub
Other best practices for preventing LLMjacking in a cloud environment include good credential hygiene by using a centralized secrets-management platform; least privilege by ensuring users and service accounts only possess the permissions necessary for their specific role and required tasks; and code monitoring by automating secret scanning within codebases such as GitHub and GitLab.
organisation GitLab
Other best practices for preventing LLMjacking in a cloud environment include good credential hygiene by using a centralized secrets-management platform; least privilege by ensuring users and service accounts only possess the permissions necessary for their specific role and required tasks; and code monitoring by automating secret scanning within codebases such as GitHub and GitLab.
financial $60
One such service is Jet Night ("jet-night[.]com"), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month.
organisation Claude Code CLI
Shortly after the legitimate install of the Codex or Claude Code CLI through npm, users are likely instructed to run a one-line command to fetch fileless PowerShell or bash setup script from a lookalike domain ("vibe.aiok[.]me") that's used to override the configuration.
infrastructure Windows
The script also checks the Windows locale setting to confirm it's running on a system in the region it serves before the setup is completed.
organisation Large Language Models
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.
organisation GitHub Personal Access Tokens
The most common initial access vector has been exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), and active session tokens, which allow an attacker to establish an initial foothold into target organizations' infrastructure.
organisation Google
"UNC6993 also hosted a session hijacking page masquerading as an application portal to join a group of LLM users," Google said.
organisation Personal Access Token
In another case, an unknown attacker has been observed leveraging a stolen Personal Access Token to access private code repositories, following it up with the exploitation of a suspected web application vulnerability in a package running within a containerized cloud environment.
organisation OpenAI
"It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex's case by setting it to 'danger-full-access,' and routes every request through its own servers instead of OpenAI's or Anthropic's.
organisation Western AI
It's suspected that the operators behind the service are not only circumventing regional restrictions imposed by Western AI vendors, but are also reselling capacity below market rates similar to Jet Night.
organisation Model Resources
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources.
Tactical Metrics
Metrics
financial
$100K
Financial Impact
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.
Related: External Teams Chats Anchor 15-Minute Malware Delivery "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked," they wrote.
"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.
" UNC6993, for instance, has created additional API keys to scale their operations within victim cloud projects, racking up over $100,000 USD in billing charges.
Unlike cryptojacking's gradual consumption, LLMJacking generates massive spikes in fraudulent cloud charges, with incidents exceeding $100,000 USD daily and reaching $1 million USD cumulatively.
Metrics
financial
$1M
Financial Impact
Google: LLMjacking attacks rack up $1 million in cloud AI charges.
Related: External Teams Chats Anchor 15-Minute Malware Delivery "Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked," they wrote.
Cybercriminals have created a thriving business model out of stealing cloud access to commercial large language models (LLMs) and reselling it to paying customers, with the resource cost for victims reaching high as $1 million before access to their LLM was revoked.
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges.
"Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.
Unlike cryptojacking's gradual consumption, LLMJacking generates massive spikes in fraudulent cloud charges, with incidents exceeding $100,000 USD daily and reaching $1 million USD cumulatively.
Metrics
financial
$60
Financial Impact
One such service is Jet Night ("jet-night[.]com"), which offers an unlimited token plan with alleged access to a frontier model for approximately $60 per month.
Metrics
infrastructure
‎Windows
Affected Product
The script also checks the Windows locale setting to confirm it's running on a system in the region it serves before the setup is completed.
Intelligence Sources
AlienVault OTX 2026-11-02
The Hacker News 2026-11-03
Dark Reading 2026-11-03
AlienVault OTX 2026-11-03