LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
Executive Summary
Executive Summary In 2026, Google Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks targeting enterprises across financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific. Threat actors—including the tracked cluster UNC6993—obtained cloud credentials via phishing, misconfigured Service Account keys, exposed GitHub Personal Access Tokens, and public code repositories to gain unauthorized access to enterprise LLM APIs. After establishing a foothold, attackers escalated privileges, performed multi-region reconnaissance, cloned codebases for hard-coded secrets, and created backdoor service accounts. Fraudulent LLM consumption exceeded $100,000 USD in a single day at individual organizations, with cumulative charges reaching $1 million USD before access was revoked.
LLMjacking represents a structural evolution beyond cryptojacking, exploiting the high per-token cost of frontier AI models and the emergence of underground LLM Mixer services that proxy and resell stolen enterprise LLM access. As agentic AI workflows proliferate in production cloud environments, the attack surface for credential-based API abuse is expanding rapidly, making cloud identity hygiene and real-time egress enforcement urgent priorities for security teams in 2026 and beyond.
Why This Matters Now
Why This Matters NowEnterprises are rapidly integrating high-cost frontier AI models and agentic workflows into production, creating a lucrative new target class. LLM Mixer underground markets now enable instant monetization of stolen API credentials, meaning a single exposed token can generate six-figure fraudulent charges within hours—before most organizations detect the anomaly. Regulatory and financial exposure from these incidents is accelerating in 2026.
Attack Path Analysis
Attack Path AnalysisLLMjacking attacks began with the theft or exposure of cloud identity credentials such as IAM keys, Service Account keys, GitHub PATs, and session tokens obtained through phishing, misconfigured environments, or public repository leaks. Attackers escalated privileges by exploiting overly permissive service accounts, abusing token-creation rights, and leveraging CVE-2026-40217 in LiteLLM middleware, then moved laterally across cloud regions and code repositories to harvest additional credentials. Command and control was established through unauthorized proxy endpoints and agentic workloads hosted within victim cloud projects, ultimately enabling mass LLM API consumption, illicit token resale via underground LLM Mixer services, and catastrophic fraudulent billing charges reaching up to one million USD per organization.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers obtained initial access via exposed or stolen cloud identity tokens including IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens sourced from phishing campaigns, misconfigured cloud environments, exposed client-side code, and public GitHub repositories. UNC6993 additionally operated a session hijacking page masquerading as an application portal to steal raw JSON access tokens from users, bypassing MFA. A separate actor exploited a suspected web application vulnerability in a containerized cloud environment after accessing private repositories via a stolen PAT.
Related CVEs
Related CVEsCVE-2025-27489
CVSS 7.8LiteLLM, an open-source LLM routing and proxy middleware, contains a privilege escalation vulnerability that allows an authenticated attacker to escalate privileges and potentially achieve remote code execution within cloud-hosted LLM routing deployments.
Affected Products:
BerriAI LiteLLM – < 1.63.11
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesValid Accounts
Unsecured Credentials: Credentials In Files
Steal Web Session Cookie
Account Manipulation
Permission Groups Discovery: Cloud Groups
Cloud Infrastructure Discovery
Resource Hijacking
Trusted Relationship
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Identification and Authentication Management
Control ID: Requirement 8.2 / 8.6
NYDFS 23 NYCRR 500 – Access Privileges and Multi-Factor Authentication
Control ID: Section 500.7 / 500.12
DORA (Digital Operational Resilience Act) – ICT Security and Access Control / Detection Capabilities
Control ID: Article 9 / Article 10
CISA Zero Trust Maturity Model 2.0 – Identity Verification and Least Privilege Enforcement
Control ID: Identity Pillar: Advanced / Optimal / Networks Pillar: Micro-segmentation
NIS2 Directive – Supply Chain Security and Incident Handling
Control ID: Article 21 – Security of Network and Information Systems
ISO/IEC 27001:2022 – Privileged Access Management and Credential Security
Control ID: Annex A 8.2 / 8.3 / 8.18
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
LLMjacking attacks directly targeting financial services via stolen IAM credentials and API keys risk $1M+ fraudulent cloud charges, exposing compliance gaps across PCI 4.0, NIST 800-53, and Zero Trust segmentation controls.
Information Technology/IT
IT organizations face critical cloud resource hijacking exposure through misconfigured service accounts, exposed GitHub PATs, and LiteLLM CVE exploitation, demanding multicloud visibility, egress policy enforcement, and anomaly detection capabilities.
Semiconductors
Explicitly named in blog_body, semiconductor firms are targeted by unauthorized AI relay services reconfiguring Claude and Codex CLIs, risking proprietary IP exfiltration and NIST CSF PR.DS-5 compliance violations.
Industrial Automation
Industrial automation sectors face LLMjacking via trojanized AI coding tool configurations, enabling cloud credential theft and lateral movement across OT-adjacent systems, undermining Zero Trust segmentation and east-west traffic security controls.
Sources
Sources- Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Chargeshttps://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.htmlVerified
- LLMjacking: Monetizing Compromised Cloud Modelshttps://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-modelsVerified
- LiteLLM Privilege Escalation and RCE Vulnerabilityhttps://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rceVerified
- OpenAI and Claude Unauthorized Relay Service Analysishttps://www.security.com/threat-intelligence/openai-claude-unauthorized-relaysVerified
- NVD Entry: CVE-2025-27489 LiteLLM Privilege Escalationhttps://nvd.nist.gov/vuln/detail/CVE-2025-27489Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this LLMjacking campaign because attackers relied on unrestricted cloud identity reachability and open east-west paths to pivot across projects, regions, and LLM API endpoints. By enforcing identity-aware segmentation and controlled egress, CNSF would likely reduce the blast radius available to actors operating on stolen credentials.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Even with a stolen token in hand, the attacker's ability to reach LLM API endpoints, internal cloud services, or cross-project resources would likely be constrained by network-layer segmentation that does not implicitly trust cloud identities alone, reducing how far an exposed credential could actually carry an attacker.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the reachability of newly escalated credentials by ensuring that even a freshly minted high-privilege token cannot freely traverse to LLM routing infrastructure or adjacent cloud services without passing through enforced segment boundaries, reducing the operational value of escalated access.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to pivot freely between cloud projects, regions, and internal services, since lateral movement paths between workloads and storage systems would need to traverse enforced segment boundaries rather than relying on flat cloud network trust.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface unauthorized proxy workloads and unexpected inter-cloud communication patterns, and could reduce the reachability of attacker-hosted agentic endpoints by flagging or constraining workloads communicating outside defined multicloud policy boundaries.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely reduce the attacker's ability to route LLM API traffic, exfiltrated secrets, and cloned repository data to external attacker-controlled infrastructure, since outbound paths to unauthorized destinations could be constrained by egress policy rather than relying on open cloud internet gateways.
Had segmentation, east-west controls, and egress enforcement been in place at earlier stages, the attacker's ability to sustain mass LLM API consumption across cloud projects and regions would likely have been reduced in scope — meaning the volume of fraudulent billing, the breadth of credential compromise, and the reach into additional downstream services would likely have been more limited than what was observed.
Impact at a Glance
Affected Business Functions
- Cloud AI/LLM API Services and Quota Management
- Cloud Identity and Access Management (IAM)
- Software Development and Code Repository Integrity
- Financial Operations and Cloud Cost Controls
Estimated downtime: 7 days
Estimated loss: $1,000,000
Exposure of cloud IAM credentials, Service Account keys, GitHub Personal Access Tokens (PATs), active session tokens, hard-coded secrets and configuration variables from cloned code repositories, internal database passwords, third-party API keys extracted from cloud secret managers, and infrastructure credentials. Affected organizations span financial services, retail, technology, and transportation sectors across North America, South America, and Asia Pacific. Secondary exposure risk includes proprietary source code and developer credentials stored in private repositories.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Native Security Fabric (CNSF) with inline enforcement and real-time inspection across all cloud environments to detect anomalous LLM API usage patterns, shadow AI activity, and unauthorized agentic workloads before fraudulent billing charges accumulate.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation policies to restrict service account permissions to least-privilege boundaries, preventing lateral movement across cloud regions and blocking exploitation of overly permissive IAM roles and token-creation privileges.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls to block unauthorized LLM API proxy endpoints, prevent routing of enterprise LLM traffic through third-party relay infrastructure, and detect data exfiltration of credentials and API keys to unauthorized destinations.
- • Activate Multicloud Visibility and Control with centralized traffic observability and anomaly detection to identify suspicious automation patterns such as rapid API key creation and deletion, high-volume LLM token consumption spikes, and reconnaissance activity across cloud regions and code repositories.
- • Enable East-West Traffic Security controls to monitor and restrict workload-to-workload and service-to-service communications, preventing internal reconnaissance of cloud secret managers and code repositories, and blocking lateral credential harvesting across containerized cloud environments.
