Token Thieves Costing Companies $100K+ Daily in Illicit LLM Charges
Criminals are increasingly hijacking corporate LLM access, a tactic dubbed LLMJacking, leading to significant financial losses for victim organizations.
Criminals are increasingly hijacking corporate Large Language Model (LLM) access, a tactic dubbed LLMJacking, leading to significant financial losses for victim organizations. Attackers steal API keys and tokens to generate fraudulent charges, with some companies facing over $100,000 in daily costs and cumulative losses reaching $1 million. This abuse involves generating additional keys, enabling cloud services, and subscribing victim accounts to premium models, with threat actors employing strategies like "burn and rotate" to bypass rate limits and maintain illicit access.
According to a report by Google's Mandiant, these fraudulent charges from resource consumption can exceed $100,000 a day, with cumulative charges at some organizations hitting $1 million before the victim companies revoked intruders' access. "Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties,” John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register. “Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.”
This tactic of hijacking access to LLMs, LLMJacking, has been increasing steadily over the past two years. In one extreme case documented in an August report from CrowdStrike, a token thief sent approximately 200,000 API requests in just two minutes. In another instance detailed in a Google report, a group tracked as UNC6993 illicitly gained access to LLM API keys, then generated additional keys and enabled services within the victim’s cloud projects, racking up $100,000 in charges.
The threat intelligence business also documented a different token thief subscribing victim accounts to Pay-As-You-Go agreements to access advanced models on the victim company’s dime. The crook selected premium foundation models, launched high-volume inference streams, and used a “burn and rotate strategy” to bypass rate limits by creating and deleting short-lived service accounts while auditing the billing interface to monitor financial impact.
In yet another incident, an intruder executed more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys to power a token routing service called Jet Night. Google's report suggests that Jet Night's per-token costs to users are so far below typical market rates that the service likely relies on stolen keys to operate profitably. Jet Night has also admitted to multiple outages on its public Telegram channel, which Google threat hunters note is “likely due to stolen keys being revoked as victims discover their respective compromises.”
As more criminals join the LLMJacking ecosystem, Google has documented a division of labor between those who establish initial access to compromised cloud and AI services and those who manage downstream monetization infrastructure, referred to as “LLM Mixers.” In one case Mandiant responded to in mid-2026, UNC6993 compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to a model API. The crooks also spun up a session hijacking page purporting to be an application portal to join a group of LLM users.
Google predicts that miscreants will “increasingly prioritize LLMJacking” compared to other types of resource theft like cryptojacking. To prevent cloud LLM service abuse, security firms recommend prioritizing identity and access management, supply chain security, and using a centralized secrets management platform to rotate keys and secrets. Applying least-access privileges to users and service accounts, ensuring they only have permissions necessary to complete their roles, and automating secrets scanning within codebases to identify and remove any API keys and secrets added to source code are also crucial preventative measures.