In 2026, cybersecurity firm Mandiant uncovered a series of incidents where threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic dubbed LLMJacking. These attacks spanned multiple cloud and LLM providers, affecting organizations across North America, South America, and Asia Pacific in sectors like financial services, retail, technology, and transportation. Unlike cryptojacking, LLMJacking can lead to massive spikes in fraudulent cloud charges, with some incidents racking up over $100,000 USD in a single day and cumulative charges reaching $1 million USD before access was revoked.
The Google Threat Intelligence Group (GTIG) identified a diverse set of financially motivated threat clusters operating globally. As the LLMJacking ecosystem matures, a division of labor has emerged between actors establishing initial access and those managing monetization infrastructure, known as LLM Mixers. These mixers act as illicit gateways, proxying and reselling unauthorized LLM access to underground subscribers.
Initial access often involves exploiting exposed or stolen cloud identity tokens, such as IAM credentials, GitHub Personal Access Tokens (PATs), and active session tokens. Threat actors also target LLM API keys, sometimes harvesting them from public GitHub repositories. Once inside, attackers escalate privileges, conduct internal reconnaissance, and establish persistence by creating unauthorized IAM and service accounts or injecting SSH keys into compute instances.
In one case, a threat actor compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to an LLM API. Another actor gained entry by combining a stolen PAT with the exploitation of a web application vulnerability. The attacks highlight the need for organizations to secure their infrastructure and monitor for unusual API request spikes.